<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
  <head>
    <title>HCR_EL2</title>
    <link href="insn.css" rel="stylesheet" type="text/css"/>
  </head>
  <body><table style="margin: 0 auto;"><tr><td><div class="topbar"><a href="AArch32-regindex.html">AArch32 Registers</a></div></td><td><div class="topbar"><a href="AArch64-regindex.html">AArch64 Registers</a></div></td><td><div class="topbar"><a href="AArch32-sysindex.html">AArch32 Instructions</a></div></td><td><div class="topbar"><a href="AArch64-sysindex.html">AArch64 Instructions</a></div></td><td><div class="topbar"><a href="enc_index.html">Index by Encoding</a></div></td><td><div class="topbar"><a href="ext_alpha_index.html">External Registers</a></div></td><td><div class="topbar"><a href="ext_enc_index.html">External Registers by Offset</a></div></td><td><div class="topbar"><a href="func_index.html">Registers by Functional Group</a></div></td><td><div class="topbar"><a href="notice.html">Proprietary Notice</a></div></td></tr></table><hr/><h1 class="register-section">HCR_EL2, Hypervisor Configuration Register</h1><p>The HCR_EL2 characteristics are:</p><h2>Purpose</h2>
        <p>Provides configuration controls for virtualization, including defining whether various operations are trapped to EL2.</p>
      <h2>Configuration</h2><p>AArch64 System register HCR_EL2 bits [31:0] are architecturally mapped to AArch32 System register <a href="AArch32-hcr.html">HCR[31:0]</a>.</p><p>AArch64 System register HCR_EL2 bits [63:32] are architecturally mapped to AArch32 System register <a href="AArch32-hcr2.html">HCR2[31:0]</a>.</p>
        <p>If EL2 is not implemented, this register is <span class="arm-defined-word">RES0</span> from EL3.</p>

      
        <p>The bits in this register behave as if they are 0 for all purposes other than direct reads of the register if EL2 is not enabled in the current Security state.</p>
      <h2>Attributes</h2>
        <p>HCR_EL2 is a 64-bit register.</p>
      <h2>Field descriptions</h2><table class="regdiagram"><thead><tr><td>63</td><td>62</td><td>61</td><td>60</td><td>59</td><td>58</td><td>57</td><td>56</td><td>55</td><td>54</td><td>53</td><td>52</td><td>51</td><td>50</td><td>49</td><td>48</td><td>47</td><td>46</td><td>45</td><td>44</td><td>43</td><td>42</td><td>41</td><td>40</td><td>39</td><td>38</td><td>37</td><td>36</td><td>35</td><td>34</td><td>33</td><td>32</td></tr></thead><tfoot><tr><td>31</td><td>30</td><td>29</td><td>28</td><td>27</td><td>26</td><td>25</td><td>24</td><td>23</td><td>22</td><td>21</td><td>20</td><td>19</td><td>18</td><td>17</td><td>16</td><td>15</td><td>14</td><td>13</td><td>12</td><td>11</td><td>10</td><td>9</td><td>8</td><td>7</td><td>6</td><td>5</td><td>4</td><td>3</td><td>2</td><td>1</td><td>0</td></tr></tfoot><tbody><tr class="firstrow"><td class="lr" colspan="4"><a href="#fieldset_0-63_60-1">TWEDEL</a></td><td class="lr" colspan="1"><a href="#fieldset_0-59_59-1">TWEDEn</a></td><td class="lr" colspan="1"><a href="#fieldset_0-58_58-1">TID5</a></td><td class="lr" colspan="1"><a href="#fieldset_0-57_57-1">DCT</a></td><td class="lr" colspan="1"><a href="#fieldset_0-56_56-1">ATA</a></td><td class="lr" colspan="1"><a href="#fieldset_0-55_55-1">TTLBOS</a></td><td class="lr" colspan="1"><a href="#fieldset_0-54_54-1">TTLBIS</a></td><td class="lr" colspan="1"><a href="#fieldset_0-53_53-1">EnSCXT</a></td><td class="lr" colspan="1"><a href="#fieldset_0-52_52-1">TOCU</a></td><td class="lr" colspan="1"><a href="#fieldset_0-51_51-1">AMVOFFEN</a></td><td class="lr" colspan="1"><a href="#fieldset_0-50_50-1">TICAB</a></td><td class="lr" colspan="1"><a href="#fieldset_0-49_49-1">TID4</a></td><td class="lr" colspan="1"><a href="#fieldset_0-48_48-1">GPF</a></td><td class="lr" colspan="1"><a href="#fieldset_0-47_47-1">FIEN</a></td><td class="lr" colspan="1"><a href="#fieldset_0-46_46-1">FWB</a></td><td class="lr" colspan="1"><a href="#fieldset_0-45_45-1">NV2</a></td><td class="lr" colspan="1"><a href="#fieldset_0-44_44-1">AT</a></td><td class="lr" colspan="1"><a href="#fieldset_0-43_43-1">NV1</a></td><td class="lr" colspan="1"><a href="#fieldset_0-42_42-1">NV</a></td><td class="lr" colspan="1"><a href="#fieldset_0-41_41-1">API</a></td><td class="lr" colspan="1"><a href="#fieldset_0-40_40-1">APK</a></td><td class="lr" colspan="1"><a href="#fieldset_0-39_39-1">TME</a></td><td class="lr" colspan="1"><a href="#fieldset_0-38_38">MIOCNCE</a></td><td class="lr" colspan="1"><a href="#fieldset_0-37_37-1">TEA</a></td><td class="lr" colspan="1"><a href="#fieldset_0-36_36-1">TERR</a></td><td class="lr" colspan="1"><a href="#fieldset_0-35_35-1">TLOR</a></td><td class="lr" colspan="1"><a href="#fieldset_0-34_34-1">E2H</a></td><td class="lr" colspan="1"><a href="#fieldset_0-33_33">ID</a></td><td class="lr" colspan="1"><a href="#fieldset_0-32_32">CD</a></td></tr><tr class="firstrow"><td class="lr" colspan="1"><a href="#fieldset_0-31_31-1">RW</a></td><td class="lr" colspan="1"><a href="#fieldset_0-30_30">TRVM</a></td><td class="lr" colspan="1"><a href="#fieldset_0-29_29-1">HCD</a></td><td class="lr" colspan="1"><a href="#fieldset_0-28_28">TDZ</a></td><td class="lr" colspan="1"><a href="#fieldset_0-27_27">TGE</a></td><td class="lr" colspan="1"><a href="#fieldset_0-26_26">TVM</a></td><td class="lr" colspan="1"><a href="#fieldset_0-25_25">TTLB</a></td><td class="lr" colspan="1"><a href="#fieldset_0-24_24">TPU</a></td><td class="lr" colspan="1"><a href="#fieldset_0-23_23-1">Bit[23]</a></td><td class="lr" colspan="1"><a href="#fieldset_0-22_22">TSW</a></td><td class="lr" colspan="1"><a href="#fieldset_0-21_21">TACR</a></td><td class="lr" colspan="1"><a href="#fieldset_0-20_20">TIDCP</a></td><td class="lr" colspan="1"><a href="#fieldset_0-19_19">TSC</a></td><td class="lr" colspan="1"><a href="#fieldset_0-18_18">TID3</a></td><td class="lr" colspan="1"><a href="#fieldset_0-17_17">TID2</a></td><td class="lr" colspan="1"><a href="#fieldset_0-16_16">TID1</a></td><td class="lr" colspan="1"><a href="#fieldset_0-15_15-1">TID0</a></td><td class="lr" colspan="1"><a href="#fieldset_0-14_14">TWE</a></td><td class="lr" colspan="1"><a href="#fieldset_0-13_13">TWI</a></td><td class="lr" colspan="1"><a href="#fieldset_0-12_12">DC</a></td><td class="lr" colspan="2"><a href="#fieldset_0-11_10">BSU</a></td><td class="lr" colspan="1"><a href="#fieldset_0-9_9">FB</a></td><td class="lr" colspan="1"><a href="#fieldset_0-8_8">VSE</a></td><td class="lr" colspan="1"><a href="#fieldset_0-7_7">VI</a></td><td class="lr" colspan="1"><a href="#fieldset_0-6_6">VF</a></td><td class="lr" colspan="1"><a href="#fieldset_0-5_5">AMO</a></td><td class="lr" colspan="1"><a href="#fieldset_0-4_4">IMO</a></td><td class="lr" colspan="1"><a href="#fieldset_0-3_3">FMO</a></td><td class="lr" colspan="1"><a href="#fieldset_0-2_2">PTW</a></td><td class="lr" colspan="1"><a href="#fieldset_0-1_1">SWIO</a></td><td class="lr" colspan="1"><a href="#fieldset_0-0_0">VM</a></td></tr></tbody></table><h4 id="fieldset_0-63_60-1">TWEDEL, bits [63:60]<span class="condition"><br/>When FEAT_TWED is implemented:
                        </span></h4><div class="field">
      <p>TWE Delay. A 4-bit unsigned number that, when HCR_EL2.TWEDEn is 1, encodes the minimum delay in taking a trap of WFE* caused by HCR_EL2.TWE as 2<sup>(TWEDEL + 8)</sup> cycles.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-63_60-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-59_59-1">TWEDEn, bit [59]<span class="condition"><br/>When FEAT_TWED is implemented:
                        </span></h4><div class="field">
      <p>TWE Delay Enable. Enables a configurable delayed trap of the WFE* instruction caused by HCR_EL2.TWE.</p>
    <table class="valuetable"><tr><th>TWEDEn</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>The delay for taking the trap is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span>.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>The delay for taking the trap is at least the number of cycles defined in HCR_EL2.TWEDEL.</p>
        </td></tr></table><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-59_59-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-58_58-1">TID5, bit [58]<span class="condition"><br/>When FEAT_MTE2 is implemented:
                        </span></h4><div class="field"><p>Trap ID group 5. Traps the following register accesses to EL2, when EL2 is enabled in the current Security state:</p>
<p>AArch64:</p>
<ul>
<li><a href="AArch64-gmid_el1.html">GMID_EL1</a>.
</li></ul><table class="valuetable"><tr><th>TID5</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>The specified EL1 and EL0 accesses to ID group 5 registers are trapped to EL2.</p>
        </td></tr></table>
      <p>When the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field has an Effective value of 0 for all purposes other than a direct read of the value of this bit.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-58_58-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-57_57-1">DCT, bit [57]<span class="condition"><br/>When FEAT_MTE2 is implemented:
                        </span></h4><div class="field">
      <p>Default Cacheability Tagging. When HCR_EL2.DC is in effect, controls whether stage 1 translations have the Tagged attribute.</p>
    <table class="valuetable"><tr><th>DCT</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>Stage 1 translations do not have the Tagged attribute.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Stage 1 translations have the Tagged attribute.</p>
        </td></tr></table>
      <p>This bit is permitted to be cached in a TLB.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-57_57-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-56_56-1">ATA, bit [56]<span class="condition"><br/>When FEAT_MTE2 is implemented:
                        </span></h4><div class="field">
      <p>Allocation Tag Access. When HCR_EL2.{E2H,TGE} != {1,1}, controls access to Allocation Tags, System registers for Memory tagging, and prevention of Tag checking, at EL1 and EL0.</p>
    <table class="valuetable"><tr><th>ATA</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td><p>Access to Allocation Tags is prevented at EL1 and EL0.</p>
<p>Accesses at EL1 to <a href="AArch64-gcr_el1.html">GCR_EL1</a>, <a href="AArch64-rgsr_el1.html">RGSR_EL1</a>, <a href="AArch64-tfsr_el1.html">TFSR_EL1</a>, or <a href="AArch64-tfsre0_el1.html">TFSRE0_EL1</a> that are not <span class="arm-defined-word">UNDEFINED</span> are trapped to EL2.</p>
<p>Accesses at EL1 using MRS or MSR with the register name TFSR_EL2 that are not <span class="arm-defined-word">UNDEFINED</span> are trapped to EL3.</p>
<p>Memory accesses at EL1 and EL0 are not subject to a Tag Check operation.</p></td></tr><tr><td class="bitfield">0b1</td><td><p>This control does not prevent access to Allocation Tags at EL1 and EL0.</p>
<p>This control does not prevent Tag checking at EL1 and EL0.</p></td></tr></table><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-56_56-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-55_55-1">TTLBOS, bit [55]<span class="condition"><br/>When FEAT_EVT is implemented:
                        </span></h4><div class="field"><p>Trap TLB maintenance instructions that operate on the Outer Shareable domain. Traps execution of those TLB maintenance instructions at EL1 to EL2, when EL2 is enabled in the current Security state. This applies to the following instructions:</p>
<p><a href="AArch64-tlbi-vmalle1os.html">TLBI VMALLE1OS</a>, <a href="AArch64-tlbi-vae1os.html">TLBI VAE1OS</a>, <a href="AArch64-tlbi-aside1os.html">TLBI ASIDE1OS</a>,<a href="AArch64-tlbi-vaae1os.html">TLBI VAAE1OS</a>, <a href="AArch64-tlbi-vale1os.html">TLBI VALE1OS</a>, <a href="AArch64-tlbi-vaale1os.html">TLBI VAALE1OS</a>,<a href="AArch64-tlbi-rvae1os.html">TLBI RVAE1OS</a>, <a href="AArch64-tlbi-rvaae1os.html">TLBI RVAAE1OS</a>,<a href="AArch64-tlbi-rvale1os.html">TLBI RVALE1OS</a>, and <a href="AArch64-tlbi-rvaale1os.html">TLBI RVAALE1OS</a>.</p><table class="valuetable"><tr><th>TTLBOS</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Execution of the specified instructions are trapped to EL2.</p>
        </td></tr></table>
      <p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-55_55-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-54_54-1">TTLBIS, bit [54]<span class="condition"><br/>When FEAT_EVT is implemented:
                        </span></h4><div class="field"><p>Trap TLB maintenance instructions that operate on the Inner Shareable domain. Traps execution of those TLB maintenance instructions at EL1 to EL2, when EL2 is enabled in the current Security state. This applies to the following instructions:</p>
<ul>
<li>When EL1 is using AArch64, <a href="AArch64-tlbi-vmalle1is.html">TLBI VMALLE1IS</a>, <a href="AArch64-tlbi-vae1is.html">TLBI VAE1IS</a>, <a href="AArch64-tlbi-aside1is.html">TLBI ASIDE1IS</a>, <a href="AArch64-tlbi-vaae1is.html">TLBI VAAE1IS</a>, <a href="AArch64-tlbi-vale1is.html">TLBI VALE1IS</a>, <a href="AArch64-tlbi-vaale1is.html">TLBI VAALE1IS</a>, <a href="AArch64-tlbi-rvae1is.html">TLBI RVAE1IS</a>, <a href="AArch64-tlbi-rvaae1is.html">TLBI RVAAE1IS</a>, <a href="AArch64-tlbi-rvale1is.html">TLBI RVALE1IS</a>, and <a href="AArch64-tlbi-rvaale1is.html">TLBI RVAALE1IS</a>.
</li><li>When EL1 is using AArch32, <a href="AArch32-tlbiallis.html">TLBIALLIS</a>, <a href="AArch32-tlbimvais.html">TLBIMVAIS</a>, <a href="AArch32-tlbiasidis.html">TLBIASIDIS</a>, <a href="AArch32-tlbimvaais.html">TLBIMVAAIS</a>, <a href="AArch32-tlbimvalis.html">TLBIMVALIS</a>, and <a href="AArch32-tlbimvaalis.html">TLBIMVAALIS</a>.
</li></ul><table class="valuetable"><tr><th>TTLBIS</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Execution of the specified instructions are trapped to EL2.</p>
        </td></tr></table>
      <p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-54_54-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-53_53-1">EnSCXT, bit [53]<span class="condition"><br/>When FEAT_CSV2_2 is implemented or FEAT_CSV2_1p2 is implemented:
                        </span></h4><div class="field">
      <p>Enable Access to the <a href="AArch64-scxtnum_el1.html">SCXTNUM_EL1</a> and <a href="AArch64-scxtnum_el0.html">SCXTNUM_EL0</a> registers. The defined values are:</p>
    <table class="valuetable"><tr><th>EnSCXT</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td><p>When EL2 is enabled in the current Security state, EL1 accesses to SCXTNUM_EL0 and SCXTNUM_EL1 are disabled, causing an exception to EL2, and the value of the registers to be treated as 0.</p>
<p>When HCR_EL2.E2H is 0 or HCR_EL2.TGE is 0, and EL2 is enabled in the current Security state, EL0 access to SCXTNUM_EL0 is disabled, causing an exception to EL2, and the value of the register to be treated as 0.</p></td></tr><tr><td class="bitfield">0b1</td><td>
          <p>This control does not cause accesses to <a href="AArch64-scxtnum_el0.html">SCXTNUM_EL0</a> or <a href="AArch64-scxtnum_el1.html">SCXTNUM_EL1</a> to be trapped.</p>
        </td></tr></table>
      <p>When FEAT_VHE is implemented, the value of HCR_EL2.{E2H, TGE} is {1,1}, and the value of this field is <span class="binarynumber">0b0</span>, accesses at EL0 are not trapped by this control.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-53_53-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-52_52-1">TOCU, bit [52]<span class="condition"><br/>When FEAT_EVT is implemented:
                        </span></h4><div class="field"><p>Trap cache maintenance instructions that operate to the Point of Unification. Traps execution of those cache maintenance instructions to EL2, when EL2 is enabled in the current Security state. This applies to the following instructions:</p>
<ul>
<li>When <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.UCI is 1, HCR_EL2.{TGE, E2H} is not {1, 1}, and EL0 is using AArch64, <a href="AArch64-ic-ivau.html">IC IVAU</a>, <a href="AArch64-dc-cvau.html">DC CVAU</a>.
</li><li>When EL1 is using AArch64, <a href="AArch64-ic-ivau.html">IC IVAU</a>, <a href="AArch64-ic-iallu.html">IC IALLU</a>, <a href="AArch64-dc-cvau.html">DC CVAU</a>.
</li><li>When EL1 is using AArch32, <a href="AArch32-icimvau.html">ICIMVAU</a>, <a href="AArch32-iciallu.html">ICIALLU</a>, <a href="AArch32-dccmvau.html">DCCMVAU</a>.
</li></ul>
<div class="note"><span class="note-header">Note</span><p>An exception generated because an instruction is <span class="arm-defined-word">UNDEFINED</span> at EL0 is higher priority than this trap to EL2. In addition:</p><ul><li><a href="AArch64-ic-ialluis.html">IC IALLUIS</a> and <a href="AArch64-ic-iallu.html">IC IALLU</a> are always <span class="arm-defined-word">UNDEFINED</span> at EL0 using AArch64.</li><li><a href="AArch32-icimvau.html">ICIMVAU</a>, <a href="AArch32-iciallu.html">ICIALLU</a>, <a href="AArch32-icialluis.html">ICIALLUIS</a>, and <a href="AArch32-dccmvau.html">DCCMVAU</a> are always <span class="arm-defined-word">UNDEFINED</span> at EL0 using AArch32.</li></ul></div><table class="valuetable"><tr><th>TOCU</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Execution of the specified instructions are trapped to EL2.</p>
        </td></tr></table><p>If the Point of Unification is before any level of data cache, it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether the execution of any data or unified cache clean by VA to the Point of Unification instruction can be trapped when the value of this control is 1.</p>
<p>If the Point of Unification is before any level of instruction cache, it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether the execution of any instruction cache invalidate to the Point of Unification instruction can be trapped when the value of this control is 1.</p>
<p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-52_52-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-51_51-1">AMVOFFEN, bit [51]<span class="condition"><br/>When FEAT_AMUv1p1 is implemented:
                        </span></h4><div class="field">
      <p>Activity Monitors Virtual Offsets Enable.</p>
    <table class="valuetable"><tr><th>AMVOFFEN</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>Virtualization of the Activity Monitors is disabled. Indirect reads of the virtual offset registers are zero.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Virtualization of the Activity Monitors is enabled.</p>
        </td></tr></table><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-51_51-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-50_50-1">TICAB, bit [50]<span class="condition"><br/>When FEAT_EVT is implemented:
                        </span></h4><div class="field"><p>Trap ICIALLUIS/IC IALLUIS cache maintenance instructions. Traps execution of those cache maintenance instructions at EL1 to EL2, when EL2 is enabled in the current Security state. This applies to the following instructions:</p>
<ul>
<li>When EL1 is using AArch64, <a href="AArch64-ic-ialluis.html">IC IALLUIS</a>.
</li><li>When EL1 is using AArch32, <a href="AArch32-icialluis.html">ICIALLUIS</a>.
</li></ul><table class="valuetable"><tr><th>TICAB</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>EL1 execution of the specified instructions is trapped to EL2.</p>
        </td></tr></table><p>If the Point of Unification is before any level of instruction cache, it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether the execution of any instruction cache invalidate to the Point of Unification instruction can be trapped when the value of this control is 1.</p>
<p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-50_50-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-49_49-1">TID4, bit [49]<span class="condition"><br/>When FEAT_EVT is implemented:
                        </span></h4><div class="field"><p>Trap ID group 4. Traps the following register accesses to EL2, when EL2 is enabled in the current Security state:</p>
<p>AArch64:</p>
<ul>
<li>EL1 reads of <a href="AArch64-ccsidr_el1.html">CCSIDR_EL1</a>, <a href="AArch64-ccsidr2_el1.html">CCSIDR2_EL1</a>, <a href="AArch64-clidr_el1.html">CLIDR_EL1</a>, and <a href="AArch64-csselr_el1.html">CSSELR_EL1</a>.
</li><li>EL1 writes to <a href="AArch64-csselr_el1.html">CSSELR_EL1</a>.
</li></ul>
<p>AArch32:</p>
<ul>
<li>EL1 reads of <a href="AArch32-ccsidr.html">CCSIDR</a>, <a href="AArch32-ccsidr2.html">CCSIDR2</a>, <a href="AArch32-clidr.html">CLIDR</a>, and <a href="AArch32-csselr.html">CSSELR</a>.
</li><li>EL1 writes to <a href="AArch32-csselr.html">CSSELR</a>.
</li></ul><table class="valuetable"><tr><th>TID4</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>The specified EL1 and EL0 accesses to ID group 4 registers are trapped to EL2.</p>
        </td></tr></table>
      <p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-49_49-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-48_48-1">GPF, bit [48]<span class="condition"><br/>When FEAT_RME is implemented:
                        </span></h4><div class="field">
      <p>Controls the reporting of Granule protection faults at EL0 and EL1.</p>
    <table class="valuetable"><tr><th>GPF</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause exceptions to be routed from EL0 and EL1 to EL2.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Instruction Abort exceptions and Data Abort exceptions due to GPFs from EL0 and EL1 are routed to EL2.</p>
        </td></tr></table><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-48_48-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-47_47-1">FIEN, bit [47]<span class="condition"><br/>When FEAT_RASv1p1 is implemented:
                        </span></h4><div class="field">
      <p>Fault Injection Enable. Unless this bit is set to 1, accesses to the <a href="AArch64-erxpfgcdn_el1.html">ERXPFGCDN_EL1</a>, <a href="AArch64-erxpfgctl_el1.html">ERXPFGCTL_EL1</a>, and <a href="AArch64-erxpfgf_el1.html">ERXPFGF_EL1</a> registers from EL1 generate a Trap exception to EL2, when EL2 is enabled in the current Security state, reported using EC syndrome value <span class="hexnumber">0x18</span>.</p>
    <table class="valuetable"><tr><th>FIEN</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>Accesses to the specified registers from EL1 are trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr></table><p>If EL2 is disabled in the current Security state, the Effective value of HCR_EL2.FIEN is <span class="binarynumber">0b1</span>.</p>
<p>If <a href="AArch64-erridr_el1.html">ERRIDR_EL1</a>.NUM is zero, meaning no error records are implemented, or no error record accessible using System registers is owned by a node that implements the RAS Common Fault Injection Model Extension, then this bit might be <span class="arm-defined-word">RES0</span>.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-47_47-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-46_46-1">FWB, bit [46]<span class="condition"><br/>When FEAT_S2FWB is implemented:
                        </span></h4><div class="field">
      <p>Forced Write-Back. Defines the combined cacheability attributes in a 2 stage translation regime.</p>
    <table class="valuetable"><tr><th>FWB</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td><p>When this bit is 0, then:</p>
<ul>
<li>
<p>The combination of stage 1 and stage 2 translations on memory type and cacheability attributes are as described in the Armv8.0 architecture. For more information, see <span class="xref">'Combining stage 1 and stage 2 memory type attributes'</span>.</p>

</li><li>
<p>The encoding of the stage 2 memory type and cacheability attributes in bits[5:2] of the stage 2 Page or Block descriptors are as described in the Armv8.0 architecture.</p>

</li></ul></td></tr><tr><td class="bitfield">0b1</td><td><p>When this bit is 1, then:</p>
<ul>
<li>
<p>If the stage 1 translation specifies a cacheable memory type, then the stage 1 cache allocation hint is applied to the final cache allocation hint where the final memory type is cacheable.</p>

</li><li>
<p>If the stage 1 translation does not specify a cacheable memory type, then if the final memory type is cacheable, it is treated as Read-Allocate, Write-Allocate.</p>

</li></ul>
<p>The encoding of the stage 2 memory type and cacheability attributes in bits[5:2] of the stage 2 Page or Block descriptors are as described in <span class="xref">'Stage 2 memory type and Cacheability attributes when FEAT_S2FWB is enabled'</span>.</p></td></tr></table><p>In Secure state, this bit applies to both the Secure stage 2 translation and the Non-secure stage 2 translation.</p>
<p>This bit is permitted to be cached in a TLB.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-46_46-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-45_45-1">NV2, bit [45]<span class="condition"><br/>When FEAT_NV2 is implemented:
                        </span></h4><div class="field">
      <p>Nested Virtualization. Changes the behaviors of HCR_EL2.{NV1, NV} to provide a mechanism for hardware to transform reads and writes from System registers into reads and writes from memory.</p>
    <table class="valuetable"><tr><th>NV2</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This bit has no effect on the behavior of HCR_EL2.{NV1, NV}. The behavior of HCR_EL2.{NV1, NV} is as defined for <span class="xref">FEAT_NV</span>.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td><p>Redefines behavior of HCR_EL2{NV1, NV} to enable:</p>
<ul>
<li>Transformation of read/writes to registers into read/writes to memory.
</li><li>Redirection of EL2 registers to EL1 registers.
</li></ul>
<p>Any exception taken from EL1 and taken to EL1 causes <a href="AArch64-spsr_el1.html">SPSR_EL1</a>.M[3:2] to be set to <span class="binarynumber">0b10</span> and not <span class="binarynumber">0b01</span>.</p></td></tr></table>
      <p>When HCR_EL2.NV is 0, the Effective value of this field is 0 and this field is treated as 0 for all purposes other than direct reads and writes of this field.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-45_45-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-44_44-1">AT, bit [44]<span class="condition"><br/>When FEAT_NV is implemented:
                        </span></h4><div class="field"><p>Address Translation. EL1 execution of the following address translation instructions is trapped to EL2, when EL2 is enabled in the current Security state, reported using EC syndrome value <span class="hexnumber">0x18</span>:</p>
<ul>
<li><a href="AArch64-at-s1e0r.html">AT S1E0R</a>, <a href="AArch64-at-s1e0w.html">AT S1E0W</a>, <a href="AArch64-at-s1e1r.html">AT S1E1R</a>, <a href="AArch64-at-s1e1w.html">AT S1E1W</a>, <a href="AArch64-at-s1e1rp.html">AT S1E1RP</a>, <a href="AArch64-at-s1e1wp.html">AT S1E1WP</a>.
</li></ul><table class="valuetable"><tr><th>AT</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>EL1 execution of the specified instructions is trapped to EL2.</p>
        </td></tr></table><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-44_44-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-43_43-1">NV1, bit [43]<span class="condition"><br/>When FEAT_NV2 is implemented:
                        </span></h4><div class="field">
      <p>Nested Virtualization.</p>
    <table class="valuetable"><tr><th>NV1</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td><p>If HCR_EL2.{NV2, NV} are both 1, accesses executed from EL1 to implemented EL12, EL02, or EL2 registers are transformed to loads and stores.</p>
<p>If HCR_EL2.NV2 is 0 or HCR_EL2.{NV2, NV} == {1, 0}, this control does not cause any instructions to be trapped.</p></td></tr><tr><td class="bitfield">0b1</td><td><p>If HCR_EL2.NV2 is 1, accesses executed from EL1 to implemented EL2 registers are transformed to loads and stores.</p>
<p>If HCR_EL2.NV2 is 0, EL1 accesses to <a href="AArch64-vbar_el1.html">VBAR_EL1</a>, <a href="AArch64-elr_el1.html">ELR_EL1</a>, <a href="AArch64-spsr_el1.html">SPSR_EL1</a>, and, when <span class="xref">FEAT_CSV2_2</span> or <span class="xref">FEAT_CSV2_1p2</span> is implemented, <a href="AArch64-scxtnum_el1.html">SCXTNUM_EL1</a>, are trapped to EL2, when EL2 is enabled in the current Security state, and are reported using EC syndrome value <span class="hexnumber">0x18</span>.</p></td></tr></table><p>If HCR_EL2.NV2 is 1, the value of HCR_EL2.NV1 defines which EL1 register accesses are transformed to loads and stores. These transformed accesses have priority over the trapping of registers.</p>
<p>The trapping of EL1 registers caused by other control bits has priority over the transformation of these accesses.</p>
<p>If a register is specified that is not implemented by an implementation, then access to that register are <span class="arm-defined-word">UNDEFINED</span>.</p>
<p>For the list of registers affected, see <span class="xref">'Enhanced support for nested virtualization'</span>.</p>
<p>If HCR_EL2.{NV1, NV} is {0, 1}, any exception taken from EL1, and taken to EL1, causes the <a href="AArch64-spsr_el1.html">SPSR_EL1</a>.M[3:2] to be set to <span class="binarynumber">0b10</span>, and not <span class="binarynumber">0b01</span>.</p>
<p>If HCR_EL2.{NV1, NV} is {1, 1}, then:</p>
<ul>
<li>The EL1 translation table Block and Page descriptors:<ul>
<li>Bit[54] holds the PXN instead of the UXN.
</li><li>Bit[53] is <span class="arm-defined-word">RES0</span>.
</li><li>Bit[6] is treated as 0 regardless of the actual value.
</li></ul>

</li><li>If Hierarchical Permissions are enabled, the EL1 translation table Table descriptors are as follows:<ul>
<li>Bit[61] is treated as 0 regardless of the actual value.
</li><li>Bit[60] holds the PXNTable instead of the UXNTable.
</li><li>Bit[59] is <span class="arm-defined-word">RES0</span>.
</li></ul>

</li><li>When executing at EL1, the PSTATE.PAN bit is treated as zero for all purposes except reading the value of the bit.
</li><li>When executing at EL1, the LDTR* instructions are treated as the equivalent LDR* instructions, and the STTR* instructions are treated as the equivalent STR* instructions.
</li></ul>
<p>If HCR_EL2.{NV1, NV} are {1, 0}, then the behavior is a <span class="arm-defined-word">CONSTRAINED UNPREDICTABLE</span> choice of:</p>
<ul>
<li>Behaving as if HCR_EL2.NV is 1 and HCR_EL2.NV1 is 1 for all purposes other than reading back the value of the HCR_EL2.NV bit.
</li><li>Behaving as if HCR_EL2.NV is 0 and HCR_EL2.NV1 is 0 for all purposes other than reading back the value of the HCR_EL2.NV1 bit.
</li><li>Behaving with regard to the HCR_EL2.NV and HCR_EL2.NV1 bits behavior as defined in the rest of this description.
</li></ul>
<p>This bit is permitted to be cached in a TLB.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-43_43-2"><span class="condition"><br/>When FEAT_NV is implemented:
                        </span></h4><div class="field">
      <p>Nested Virtualization. EL1 accesses to certain registers are trapped to EL2, when EL2 is enabled in the current Security state.</p>
    <table class="valuetable"><tr><th>NV1</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>EL1 accesses to <a href="AArch64-vbar_el1.html">VBAR_EL1</a>, <a href="AArch64-elr_el1.html">ELR_EL1</a>, <a href="AArch64-spsr_el1.html">SPSR_EL1</a>, and, when <span class="xref">FEAT_CSV2_2</span> or <span class="xref">FEAT_CSV2_1p2</span> is implemented, <a href="AArch64-scxtnum_el1.html">SCXTNUM_EL1</a>, are trapped to EL2, when EL2 is enabled in the current Security state, and are reported using EC syndrome value <span class="hexnumber">0x18</span>.</p>
        </td></tr></table><p>If HCR_EL2.NV is 1 and HCR_EL2.NV1 is 0, then the following effects also apply:</p>
<ul>
<li>Any exception taken from EL1, and taken to EL1, causes the <a href="AArch64-spsr_el1.html">SPSR_EL1</a>.M[3:2] to be set to <span class="binarynumber">0b10</span>, and not <span class="binarynumber">0b01</span>.
</li></ul>
<p>If HCR_EL2.NV and HCR_EL2.NV1 are both set to 1, then the following effects also apply:</p>
<ul>
<li>The EL1 translation table Block and Page descriptors:<ul>
<li>Bit[54] holds the PXN instead of the UXN.
</li><li>Bit[53] is <span class="arm-defined-word">RES0</span>.
</li><li>Bit[6] is treated as 0 regardless of the actual value.
</li></ul>

</li><li>If Hierarchical Permissions are enabled, the EL1 translation table Table descriptors are as follows:<ul>
<li>Bit[61] is treated as 0 regardless of the actual value.
</li><li>Bit[60] holds the PXNTable instead of the UXNTable.
</li><li>Bit[59] is <span class="arm-defined-word">RES0</span>.
</li></ul>

</li><li>When executing at EL1, the PSTATE.PAN bit is treated as zero for all purposes except reading the value of the bit.
</li><li>When executing at EL1, the LDTR* instructions are treated as the equivalent LDR* instructions, and the STTR* instructions are treated as the equivalent STR* instructions.
</li></ul>
<p>If HCR_EL2.NV is 0 and HCR_EL2.NV1 is 1, then the behavior is a <span class="arm-defined-word">CONSTRAINED UNPREDICTABLE</span> choice of:</p>
<ul>
<li>Behaving as if HCR_EL2.NV is 1 and HCR_EL2.NV1 is 1 for all purposes other than reading back the value of the HCR_EL2.NV bit.
</li><li>Behaving as if HCR_EL2.NV is 0 and HCR_EL2.NV1 is 0 for all purposes other than reading back the value of the HCR_EL2.NV1 bit.
</li><li>Behaving with regard to the HCR_EL2.NV and HCR_EL2.NV1 bits behavior as defined in the rest of this description.
</li></ul>
<p>This bit is permitted to be cached in a TLB.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-43_43-3"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-42_42-1">NV, bit [42]<span class="condition"><br/>When FEAT_NV2 is implemented:
                        </span></h4><div class="field"><p>Nested Virtualization.</p>
<p>When HCR_EL2.NV2 is 1, redefines register accesses so that:</p>
<ul>
<li>Instructions accessing the Special purpose registers <a href="AArch64-spsr_el2.html">SPSR_EL2</a> and <a href="AArch64-elr_el2.html">ELR_EL2</a> instead access <a href="AArch64-spsr_el1.html">SPSR_EL1</a> and <a href="AArch64-elr_el1.html">ELR_EL1</a> respectively.
</li><li>Instructions accessing the System registers <a href="AArch64-esr_el2.html">ESR_EL2</a> and <a href="AArch64-far_el2.html">FAR_EL2</a> instead access <a href="AArch64-esr_el1.html">ESR_EL1</a> and <a href="AArch64-far_el1.html">FAR_EL1</a>.
</li></ul>
<p>When HCR_EL2.NV2 is 0, or if <span class="xref">FEAT_NV2</span> is not implemented, traps functionality that is permitted at EL2 and would be <span class="arm-defined-word">UNDEFINED</span> at EL1 if this field was 0, when EL2 is enabled in the current Security state. This applies to the following operations:</p>
<ul>
<li>EL1 accesses to Special-purpose registers that are not <span class="arm-defined-word">UNDEFINED</span> at EL2.
</li><li>EL1 accesses to System registers that are not <span class="arm-defined-word">UNDEFINED</span> at EL2.
</li><li>Execution of EL1 or EL2 translation regime address translation and TLB maintenance instructions for EL2 and above.
</li></ul><table class="valuetable"><tr><th>NV</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td><p>When this bit is set to 0, then the PE behaves as if HCR_EL2.NV2 is 0 for all purposes other than reading this register. This control does not cause any instructions to be trapped.</p>
<p>When HCR_EL2.NV2 is 1, no <span class="xref">FEAT_NV2</span> functionality is implemented.</p></td></tr><tr><td class="bitfield">0b1</td><td><p>When HCR_EL2.NV2 is 0, or if <span class="xref">FEAT_NV2</span> is not implemented, EL1 accesses to the specified registers or the execution of the specified instructions are trapped to EL2, when EL2 is enabled in the current Security state. EL1 read accesses to the <a href="AArch64-currentel.html">CurrentEL</a> register return a value of <span class="hexnumber">0x2</span>.</p>
<p>When HCR_EL2.NV2 is 1, this control redefines EL1 register accesses so that instructions accessing <a href="AArch64-spsr_el2.html">SPSR_EL2</a>, <a href="AArch64-elr_el2.html">ELR_EL2</a>, <a href="AArch64-esr_el2.html">ESR_EL2</a>, and <a href="AArch64-far_el2.html">FAR_EL2</a> instead access <a href="AArch64-spsr_el1.html">SPSR_EL1</a>, <a href="AArch64-elr_el1.html">ELR_EL1</a>, <a href="AArch64-esr_el1.html">ESR_EL1</a>, and <a href="AArch64-far_el1.html">FAR_EL1</a> respectively.</p></td></tr></table><p>When HCR_EL2.NV2 is 0, or if <span class="xref">FEAT_NV2</span> is not implemented, then:</p>
<ul>
<li>The System or Special-purpose registers for which accesses are trapped and reported using EC syndrome value <span class="hexnumber">0x18</span> are as follows:<ul>
<li>Registers accessed using MRS or MSR with a name ending in _EL2, except the following:<ul>
<li><a href="AArch64-sp_el2.html">SP_EL2</a>.
</li><li>If FEAT_MEC is implemented, <a href="AArch64-mecid_a0_el2.html">MECID_A0_EL2</a>, <a href="AArch64-mecid_a1_el2.html">MECID_A1_EL2</a>, <a href="AArch64-mecid_p0_el2.html">MECID_P0_EL2</a>, <a href="AArch64-mecid_p1_el2.html">MECID_P1_EL2</a>, <a href="AArch64-mecidr_el2.html">MECIDR_EL2</a>, <a href="AArch64-vmecid_a_el2.html">VMECID_A_EL2</a>, <a href="AArch64-vmecid_p_el2.html">VMECID_P_EL2</a>.
</li></ul>

</li><li>Registers accessed using MRS or MSR with a name ending in _EL12.
</li><li>Registers accessed using MRS or MSR with a name ending in _EL02.
</li><li>Special-purpose registers <a href="AArch32-spsr_irq.html">SPSR_irq</a>, <a href="AArch32-spsr_abt.html">SPSR_abt</a>, <a href="AArch32-spsr_und.html">SPSR_und</a> and <a href="AArch32-spsr_fiq.html">SPSR_fiq</a>, accessed using MRS or MSR.
</li><li>Special-purpose register <a href="AArch64-sp_el1.html">SP_EL1</a> accessed using the dedicated MRS or MSR instruction.
</li></ul>

</li><li>The instructions for which the execution is trapped and reported using EC syndrome value <span class="hexnumber">0x18</span> are as follows:<ul>
<li>EL2 translation regime Address Translation instructions and TLB maintenance instructions.
</li><li>EL1 translation regime Address Translation instructions and TLB maintenance instructions that are accessible only from EL2 and EL3.
</li></ul>

</li><li>The instructions for which the execution is trapped as follows:<ul>
<li>SMC in an implementation that does not include EL3 and when HCR_EL2.TSC is 1. HCR_EL2.TSC bit is not <span class="arm-defined-word">RES0</span> in this case. This is reported using EC syndrome value <span class="hexnumber">0x17</span>.
</li><li>The ERET, ERETAA, and ERETAB instructions, reported using EC syndrome value <span class="hexnumber">0x1A</span>.
</li></ul>

</li></ul>
<div class="note"><span class="note-header">Note</span><p>The priority of this trap is higher than the priority of the HCR_EL2.API trap. If both of these bits are set so that EL1 execution of an ERETAA or ERETAB instruction is trapped to EL2, then the syndrome reported is <span class="hexnumber">0x1A</span>.</p></div><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-42_42-2"><span class="condition"><br/>When FEAT_NV is implemented:
                        </span></h4><div class="field"><p>Nested Virtualization. Traps functionality that is permitted at EL2 and would be <span class="arm-defined-word">UNDEFINED</span> at EL1 if this field was 0, when EL2 is enabled in the current Security state. This applies to the following operations:</p>
<ul>
<li>EL1 accesses to Special-purpose registers that are not <span class="arm-defined-word">UNDEFINED</span> at EL2.
</li><li>EL1 accesses to System registers that are not <span class="arm-defined-word">UNDEFINED</span> at EL2.
</li><li>Execution of EL1 or EL2 translation regime address translation and TLB maintenance instructions for EL2 and above.
</li></ul><table class="valuetable"><tr><th>NV</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>EL1 accesses to the specified registers or the execution of the specified instructions are trapped to EL2, when EL2 is enabled in the current Security state. EL1 read accesses to the <a href="AArch64-currentel.html">CurrentEL</a> register return a value of <span class="hexnumber">0x2</span>.</p>
        </td></tr></table><p>The System or Special-purpose registers for which accesses are trapped and reported using EC syndrome value <span class="hexnumber">0x18</span> are as follows:</p>
<ul>
<li>Registers accessed using MRS or MSR with a name ending in _EL2, except the following:<ul>
<li><a href="AArch64-sp_el2.html">SP_EL2</a>.
</li><li>If FEAT_MEC is implemented, <a href="AArch64-mecid_a0_el2.html">MECID_A0_EL2</a>, <a href="AArch64-mecid_a1_el2.html">MECID_A1_EL2</a>, <a href="AArch64-mecid_p0_el2.html">MECID_P0_EL2</a>, <a href="AArch64-mecid_p1_el2.html">MECID_P1_EL2</a>, <a href="AArch64-mecidr_el2.html">MECIDR_EL2</a>, <a href="AArch64-vmecid_a_el2.html">VMECID_A_EL2</a>, <a href="AArch64-vmecid_p_el2.html">VMECID_P_EL2</a>.
</li></ul>

</li><li>Registers accessed using MRS or MSR with a name ending in _EL12.
</li><li>Registers accessed using MRS or MSR with a name ending in _EL02.
</li><li>Special-purpose registers <a href="AArch32-spsr_irq.html">SPSR_irq</a>, <a href="AArch32-spsr_abt.html">SPSR_abt</a>, <a href="AArch32-spsr_und.html">SPSR_und</a> and <a href="AArch32-spsr_fiq.html">SPSR_fiq</a>, accessed using MRS or MSR.
</li><li>Special-purpose register <a href="AArch64-sp_el1.html">SP_EL1</a> accessed using the dedicated MRS or MSR instruction.
</li></ul>
<p>The instructions for which the execution is trapped and reported using EC syndrome value <span class="hexnumber">0x18</span> are as follows:</p>
<ul>
<li>EL2 translation regime Address Translation instructions and TLB maintenance instructions.
</li><li>EL1 translation regime Address Translation instructions and TLB maintenance instructions that are accessible only from EL2 and EL3.
</li></ul>
<p>The execution of the ERET, ERETAA, and ERETAB instructions are trapped and reported using EC syndrome value <span class="hexnumber">0x1A</span>.</p>
<div class="note"><span class="note-header">Note</span><p>The priority of this trap is higher than the priority of the HCR_EL2.API trap. If both of these bits are set so that EL1 execution of an ERETAA or ERETAB instruction is trapped to EL2, then the syndrome reported is <span class="hexnumber">0x1A</span>.</p></div><p>The execution of the SMC instructions in an implementation that does not include EL3 and when HCR_EL2.TSC is 1 are trapped and reported using EC syndrome value <span class="hexnumber">0x17</span>. HCR_EL2.TSC bit is not <span class="arm-defined-word">RES0</span> in this case.</p>
<p>This bit is permitted to be cached in a TLB.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-42_42-3"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-41_41-1">API, bit [41]<span class="condition"><br/>When FEAT_PAuth is implemented:
                        </span></h4><div class="field"><p>Controls the use of instructions related to Pointer Authentication:</p>
<ul>
<li>In EL0, when HCR_EL2.TGE==0 or HCR_EL2.E2H==0, and the associated <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.En&lt;N&gt;&lt;M&gt;==1.
</li><li>In EL1, the associated <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.En&lt;N&gt;&lt;M&gt;==1.
</li></ul>
<p>Traps are reported using EC syndrome value <span class="hexnumber">0x09</span>. The Pointer Authentication instructions trapped are:</p>
<ul>
<li>AUTDA, AUTDB, AUTDZA, AUTDZB, AUTIA, AUTIA1716, AUTIASP, AUTIAZ, AUTIB, AUTIB1716, AUTIBSP, AUTIBZ, AUTIZA, AUTIZB.
</li><li>PACGA, PACDA, PACDB, PACDZA, PACDZB, PACIA, PACIA1716, PACIASP, PACIAZ, PACIB, PACIB1716, PACIBSP, PACIBZ, PACIZA, PACIZB.
</li><li>RETAA, RETAB, BRAA, BRAB, BLRAA, BLRAB, BRAAZ, BRABZ, BLRAAZ, BLRABZ.
</li><li>ERETAA, ERETAB, LDRAA, and LDRAB.
</li></ul><table class="valuetable"><tr><th>API</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td><p>The instructions related to Pointer Authentication are trapped to EL2, when EL2 is enabled in the current Security state and the instructions are enabled for the EL1&amp;0 translation regime, from:</p>
<ul>
<li>
<p>EL0 when HCR_EL2.TGE==0 or HCR_EL2.E2H==0.</p>

</li><li>
<p>EL1.</p>

</li></ul>
<p>If HCR_EL2.NV is 1, the HCR_EL2.NV trap takes precedence over the HCR_EL2.API trap for the <span class="instruction">ERETAA</span> and <span class="instruction">ERETAB</span> instructions.</p>
<p>If EL2 is implemented and enabled in the current Security state and <a href="AArch64-hfgitr_el2.html">HFGITR_EL2</a>.ERET == 1, execution at EL1 using AArch64 of <span class="instruction">ERETAA</span> or <span class="instruction">ERETAB</span> instructions is reported with EC syndrome value <span class="hexnumber">0x1A</span> with its associated ISS field, as the fine-grained trap has higher priority than the HCR_EL2.API == 0.</p></td></tr><tr><td class="bitfield">0b1</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr></table>
      <p>If <span class="xref">FEAT_PAuth</span> is implemented but EL2 is not implemented or is disabled in the current Security state, the system behaves as if this bit is 1.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-41_41-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-40_40-1">APK, bit [40]<span class="condition"><br/>When FEAT_PAuth is implemented:
                        </span></h4><div class="field"><p>Trap registers holding "key" values for Pointer Authentication. Traps accesses to the following registers from EL1 to EL2, when EL2 is enabled in the current Security state, reported using EC syndrome value <span class="hexnumber">0x18</span>:</p>
<ul>
<li><a href="AArch64-apiakeylo_el1.html">APIAKeyLo_EL1</a>, <a href="AArch64-apiakeyhi_el1.html">APIAKeyHi_EL1</a>, <a href="AArch64-apibkeylo_el1.html">APIBKeyLo_EL1</a>, <a href="AArch64-apibkeyhi_el1.html">APIBKeyHi_EL1</a>, <a href="AArch64-apdakeylo_el1.html">APDAKeyLo_EL1</a>, <a href="AArch64-apdakeyhi_el1.html">APDAKeyHi_EL1</a>, <a href="AArch64-apdbkeylo_el1.html">APDBKeyLo_EL1</a>, <a href="AArch64-apdbkeyhi_el1.html">APDBKeyHi_EL1</a>, <a href="AArch64-apgakeylo_el1.html">APGAKeyLo_EL1</a>, and <a href="AArch64-apgakeyhi_el1.html">APGAKeyHi_EL1</a>.
</li></ul><table class="valuetable"><tr><th>APK</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>Access to the registers holding "key" values for pointer authentication from EL1 are trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr></table>
      <div class="note"><span class="note-header">Note</span>
        <p>If <span class="xref">FEAT_PAuth</span> is implemented but EL2 is not implemented or is disabled in the current Security state, the system behaves as if this bit is 1.</p>
      </div>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-40_40-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-39_39-1">TME, bit [39]<span class="condition"><br/>When FEAT_TME is implemented:
                        </span></h4><div class="field">
      <p>Enables access to the TSTART, TCOMMIT, TTEST, and TCANCEL instructions at EL0 and EL1.</p>
    <table class="valuetable"><tr><th>TME</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>EL0 and EL1 accesses to TSTART, TCOMMIT, TTEST, and TCANCEL instructions are <span class="arm-defined-word">UNDEFINED</span>.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>This control does not cause any instruction to be <span class="arm-defined-word">UNDEFINED</span>.</p>
        </td></tr></table>
      <p>If EL2 is not implemented or is disabled in the current Security state, the Effective value of this bit is <span class="binarynumber">0b1</span>.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-39_39-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-38_38">MIOCNCE, bit [38]</h4><div class="field">
      <p>Mismatched Inner/Outer Cacheable Non-Coherency Enable, for the EL1&amp;0 translation regimes.</p>
    <table class="valuetable"><tr><th>MIOCNCE</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>For the EL1&amp;0 translation regimes, for permitted accesses to a memory location that use a common definition of the Shareability and Cacheability of the location, there must be no loss of coherency if the Inner Cacheability attribute for those accesses differs from the Outer Cacheability attribute.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>For the EL1&amp;0 translation regimes, for permitted accesses to a memory location that use a common definition of the Shareability and Cacheability of the location, there might be a loss of coherency if the Inner Cacheability attribute for those accesses differs from the Outer Cacheability attribute.</p>
        </td></tr></table><p>For more information, see <span class="xref">'Mismatched memory attributes'</span>.</p>
<p>This field can be implemented as RAZ/WI.</p>
<p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, the PE ignores the value of this field for all purposes other than a direct read of this field.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-37_37-1">TEA, bit [37]<span class="condition"><br/>When FEAT_RAS is implemented:
                        </span></h4><div class="field">
      <p>Route synchronous External abort exceptions to EL2.</p>
    <table class="valuetable"><tr><th>TEA</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause exceptions to be routed from EL0 and EL1 to EL2.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Route synchronous External abort exceptions from EL0 and EL1 to EL2, when EL2 is enabled in the current Security state, if not routed to EL3.</p>
        </td></tr></table><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-37_37-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-36_36-1">TERR, bit [36]<span class="condition"><br/>When FEAT_RAS is implemented:
                        </span></h4><div class="field">
      <p>Trap accesses of Error Record registers. Enables a trap to EL2 on accesses of Error Record registers.</p>
    <table class="valuetable"><tr><th>TERR</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>Accesses of the specified Error Record registers are not trapped by this mechanism.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Accesses of the specified Error Record registers at EL1 are trapped to EL2, unless the instruction generates a higher priority exception.</p>
        </td></tr></table><p>In AArch64 state, the instructions affected by this control are:</p>
<ul>
<li><span class="instruction">MRS</span> and <span class="instruction">MSR</span> accesses to <a href="AArch64-errselr_el1.html">ERRSELR_EL1</a>, <a href="AArch64-erxaddr_el1.html">ERXADDR_EL1</a>, <a href="AArch64-erxctlr_el1.html">ERXCTLR_EL1</a>, <a href="AArch64-erxmisc0_el1.html">ERXMISC0_EL1</a>, <a href="AArch64-erxmisc1_el1.html">ERXMISC1_EL1</a>, and <a href="AArch64-erxstatus_el1.html">ERXSTATUS_EL1</a>.
</li><li><span class="instruction">MRS</span> accesses to <a href="AArch64-erridr_el1.html">ERRIDR_EL1</a> and <a href="AArch64-erxfr_el1.html">ERXFR_EL1</a>.
</li><li>If <span class="xref">FEAT_RASv1p1</span> is implemented, <span class="instruction">MRS</span> and <span class="instruction">MSR</span> accesses to <a href="AArch64-erxmisc2_el1.html">ERXMISC2_EL1</a> and <a href="AArch64-erxmisc3_el1.html">ERXMISC3_EL1</a>.
</li><li>If <span class="xref">FEAT_RASv2</span> is implemented, <span class="instruction">MRS</span> accesses to <a href="AArch64-erxgsr_el1.html">ERXGSR_EL1</a>.
</li></ul>
<p>In AArch32 state, the instructions affected by this control are:</p>
<ul>
<li>
<p><span class="instruction">MRC</span> and <span class="instruction">MCR</span> accesses to <a href="AArch32-errselr.html">ERRSELR</a>, <a href="AArch32-erxaddr.html">ERXADDR</a>, <a href="AArch32-erxaddr2.html">ERXADDR2</a>, <a href="AArch32-erxctlr.html">ERXCTLR</a>, <a href="AArch32-erxctlr2.html">ERXCTLR2</a>, <a href="AArch32-erxmisc0.html">ERXMISC0</a>, <a href="AArch32-erxmisc1.html">ERXMISC1</a>, <a href="AArch32-erxmisc2.html">ERXMISC2</a>, <a href="AArch32-erxmisc3.html">ERXMISC3</a>, and <a href="AArch32-erxstatus.html">ERXSTATUS</a>.</p>

</li><li>
<p><span class="instruction">MRC</span> accesses to <a href="AArch32-erridr.html">ERRIDR</a>, <a href="AArch32-erxfr.html">ERXFR</a>, and <a href="AArch32-erxfr2.html">ERXFR2</a>.</p>

</li><li>
<p>If <span class="xref">FEAT_RASv1p1</span> is implemented, <span class="instruction">MRC</span> and <span class="instruction">MCR</span> accesses to <a href="AArch32-erxmisc4.html">ERXMISC4</a>, <a href="AArch32-erxmisc5.html">ERXMISC5</a>, <a href="AArch32-erxmisc6.html">ERXMISC6</a>, and <a href="AArch32-erxmisc7.html">ERXMISC7</a>.</p>

</li></ul>
<p>Unless the instruction generates a higher priority exception, trapped instructions generate an exception to EL2.</p>
<p>Trapped AArch64 instructions are reported using EC syndrome value <span class="hexnumber">0x18</span>.</p>
<p>Trapped AArch32 instructions are reported using EC syndrome value <span class="hexnumber">0x03</span>.</p>
<p>Accessing this field has the following behavior:</p>
<ul>
<li>This field is permitted to be <span class="arm-defined-word">RES0</span> if all of the following are true:<ul>
<li><a href="AArch64-errselr_el1.html">ERRSELR_EL1</a> and all ERX* registers are implemented as <span class="arm-defined-word">UNDEFINED</span> or RAZ/WI.
</li><li><a href="AArch64-erridr_el1.html">ERRIDR_EL1</a>.NUM is zero.
</li></ul>

</li></ul><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-36_36-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-35_35-1">TLOR, bit [35]<span class="condition"><br/>When FEAT_LOR is implemented:
                        </span></h4><div class="field">
      <p>Trap LOR registers. Traps Non-secure EL1 accesses to <a href="AArch64-lorsa_el1.html">LORSA_EL1</a>, <a href="AArch64-lorea_el1.html">LOREA_EL1</a>, <a href="AArch64-lorn_el1.html">LORN_EL1</a>, <a href="AArch64-lorc_el1.html">LORC_EL1</a>, and <a href="AArch64-lorid_el1.html">LORID_EL1</a> registers to EL2.</p>
    <table class="valuetable"><tr><th>TLOR</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Non-secure EL1 accesses to the LOR registers are trapped to EL2.</p>
        </td></tr></table>
      <p>When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-35_35-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-34_34-1">E2H, bit [34]<span class="condition"><br/>When FEAT_VHE is implemented:
                        </span></h4><div class="field">
      <p>EL2 Host. Enables a configuration where a Host Operating System is running in EL2, and the Host Operating System's applications are running in EL0.</p>
    <table class="valuetable"><tr><th>E2H</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>The facilities to support a Host Operating System at EL2 are disabled.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>The facilities to support a Host Operating System at EL2 are enabled.</p>
        </td></tr></table><p>For information on the behavior of this bit see <span class="xref">'Behavior of HCR_EL2.E2H'</span>.</p>
<p>This bit is permitted to be cached in a TLB.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-34_34-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-33_33">ID, bit [33]</h4><div class="field">
      <p>Stage 2 Instruction access cacheability disable. For the EL1&amp;0 translation regime, when EL2 is enabled in the current Security state and HCR_EL2.VM==1, this control forces all stage 2 translations for instruction accesses to Normal memory to be Non-cacheable.</p>
    <table class="valuetable"><tr><th>ID</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control has no effect on stage 2 of the EL1&amp;0 translation regime.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Forces all stage 2 translations for instruction accesses to Normal memory to be Non-cacheable.</p>
        </td></tr></table><p>This bit has no effect on the EL2, EL2&amp;0, or EL3 translation regimes.</p>
<p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, the PE ignores the value of this field for all purposes other than a direct read of this field.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-32_32">CD, bit [32]</h4><div class="field">
      <p>Stage 2 Data access cacheability disable. For the EL1&amp;0 translation regime, when EL2 is enabled in the current Security state and HCR_EL2.VM==1, this control forces all stage 2 translations for data accesses and translation table walks to Normal memory to be Non-cacheable.</p>
    <table class="valuetable"><tr><th>CD</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control has no effect on stage 2 of the EL1&amp;0 translation regime for data accesses and translation table walks.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Forces all stage 2 translations for data accesses and translation table walks to Normal memory to be Non-cacheable.</p>
        </td></tr></table><p>This bit has no effect on the EL2, EL2&amp;0, or EL3 translation regimes.</p>
<p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, the PE ignores the value of this field for all purposes other than a direct read of this field.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-31_31-1">RW, bit [31]<span class="condition"><br/>When EL1 is capable of using AArch32:
                        </span></h4><div class="field">
      <p>Execution state control for lower Exception levels:</p>
    <table class="valuetable"><tr><th>RW</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>Lower levels are all AArch32.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>The Execution state for EL1 is AArch64. The Execution state for EL0 is determined by the current value of PSTATE.nRW when executing at EL0.</p>
        </td></tr></table><p>In an implementation that includes EL3, when EL2 is not enabled in Secure state, the PE behaves as if this bit has the same value as the <a href="AArch64-scr_el3.html">SCR_EL3</a>.RW bit for all purposes other than a direct read or write access of HCR_EL2.</p>
<p>The RW bit is permitted to be cached in a TLB.</p>
<p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 1 for all purposes other than a direct read of the value of this bit.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-31_31-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, RAO/WI.</p>
    </div><h4 id="fieldset_0-30_30">TRVM, bit [30]</h4><div class="field"><p>Trap Reads of Virtual Memory controls. Traps reads of the virtual memory control registers to EL2, when EL2 is enabled in the current Security state, as follows:</p>
<ul>
<li>
<p>If EL1 is using AArch64 state, EL1 accesses to the following registers are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x18</span> for <span class="instruction">MRS</span> and <span class="hexnumber">0x14</span> for <span class="instruction">MRRS</span>:</p>
<ul>
<li>
<p><a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>, <a href="AArch64-ttbr0_el1.html">TTBR0_EL1</a>, <a href="AArch64-ttbr1_el1.html">TTBR1_EL1</a>, <a href="AArch64-tcr_el1.html">TCR_EL1</a>, <a href="AArch64-esr_el1.html">ESR_EL1</a>, <a href="AArch64-far_el1.html">FAR_EL1</a>, <a href="AArch64-afsr0_el1.html">AFSR0_EL1</a>, <a href="AArch64-afsr1_el1.html">AFSR1_EL1</a>, <a href="AArch64-mair_el1.html">MAIR_EL1</a>, <a href="AArch64-amair_el1.html">AMAIR_EL1</a>, <a href="AArch64-contextidr_el1.html">CONTEXTIDR_EL1</a>.</p>

</li><li>
<p>If FEAT_AIE is implemented, <a href="AArch64-mair2_el1.html">MAIR2_EL1</a>, <a href="AArch64-amair2_el1.html">AMAIR2_EL1</a>.</p>

</li><li>
<p>If FEAT_S1PIE is implemented, <a href="AArch64-pire0_el1.html">PIRE0_EL1</a>, <a href="AArch64-pir_el1.html">PIR_EL1</a>.</p>

</li><li>
<p>If FEAT_S1POE is implemented, <a href="AArch64-por_el0.html">POR_EL0</a>, <a href="AArch64-por_el1.html">POR_EL1</a>.</p>

</li><li>
<p>If FEAT_S2POE is implemented, <a href="AArch64-s2por_el1.html">S2POR_EL1</a>.</p>

</li><li>
<p>If FEAT_TCR2 is implemented, <a href="AArch64-tcr2_el1.html">TCR2_EL1</a>.</p>

</li><li>
<p>If FEAT_SCTLR2 is implemented, <a href="AArch64-sctlr2_el1.html">SCTLR2_EL1</a>.</p>

</li></ul>

</li><li>
<p>If HCR_EL2.{E2H, TGE} is not {1, 1}, and EL0 is using AArch64 state, EL0 accesses to the following registers are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x18</span> for <span class="instruction">MRS</span>:</p>
<ul>
<li>If FEAT_S1POE is implemented, <a href="AArch64-por_el0.html">POR_EL0</a>.
</li></ul>

</li><li>
<p>If EL1 is using AArch32 state, EL1 accesses using MRC to the following registers are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x03</span>, accesses using MRRC are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x04</span>:</p>
<ul>
<li><a href="AArch32-sctlr.html">SCTLR</a>, <a href="AArch32-ttbr0.html">TTBR0</a>, <a href="AArch32-ttbr1.html">TTBR1</a>, <a href="AArch32-ttbcr.html">TTBCR</a>, <a href="AArch32-ttbcr2.html">TTBCR2</a>, <a href="AArch32-dacr.html">DACR</a>, <a href="AArch32-dfsr.html">DFSR</a>, <a href="AArch32-ifsr.html">IFSR</a>, <a href="AArch32-dfar.html">DFAR</a>, <a href="AArch32-ifar.html">IFAR</a>, <a href="AArch32-adfsr.html">ADFSR</a>, <a href="AArch32-aifsr.html">AIFSR</a>, <a href="AArch32-prrr.html">PRRR</a>, <a href="AArch32-nmrr.html">NMRR</a>, <a href="AArch32-mair0.html">MAIR0</a>, <a href="AArch32-mair1.html">MAIR1</a>, <a href="AArch32-amair0.html">AMAIR0</a>, <a href="AArch32-amair1.html">AMAIR1</a>, <a href="AArch32-contextidr.html">CONTEXTIDR</a>.
</li></ul>

</li></ul><table class="valuetable"><tr><th>TRVM</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Read accesses to the specified Virtual Memory control registers are trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr></table><p>When HCR_EL2.{E2H, TGE} is {1, 1}, the PE ignores the value of this field for all purposes other than a direct read of this field.</p>
<div class="note"><span class="note-header">Note</span><p>EL2 provides a second stage of address translation, that a hypervisor can use to remap the address map defined by a Guest OS. In addition, a hypervisor can trap attempts by a Guest OS to write to the registers that control the memory system. A hypervisor might use this trap as part of its virtualization of memory management.</p></div><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-29_29-1">HCD, bit [29]<span class="condition"><br/>When EL3 is not implemented:
                        </span></h4><div class="field">
      <p>HVC instruction disable. Disables EL1 execution of HVC instructions, from both Execution states, when EL2 is enabled in the current Security state, reported using EC syndrome value <span class="hexnumber">0x00</span>.</p>
    <table class="valuetable"><tr><th>HCD</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>HVC instruction execution is enabled at EL2 and EL1.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>HVC instructions are <span class="arm-defined-word">UNDEFINED</span> at EL2 and EL1. Any resulting exception is taken to the Exception level at which the HVC instruction is executed.</p>
        </td></tr></table>
      <div class="note"><span class="note-header">Note</span>
        <p>HVC instructions are always <span class="arm-defined-word">UNDEFINED</span> at EL0.</p>
      </div>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-29_29-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-28_28">TDZ, bit [28]</h4><div class="field"><p>Trap <a href="AArch64-dc-zva.html">DC ZVA</a> instructions. Traps EL0 and EL1 execution of <a href="AArch64-dc-zva.html">DC ZVA</a> instructions to EL2, when EL2 is enabled in the current Security state, from AArch64 state only, reported using EC syndrome value <span class="hexnumber">0x18</span>.</p>
<p>If <span class="xref">FEAT_MTE</span> is implemented, this trap also applies to <a href="AArch64-dc-gva.html">DC GVA</a> and <a href="AArch64-dc-gzva.html">DC GZVA</a>.</p><table class="valuetable"><tr><th>TDZ</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td><p>In AArch64 state, any attempt to execute an instruction this trap applies to at EL1, or at EL0 when the instruction is not <span class="arm-defined-word">UNDEFINED</span> at EL0, is trapped to EL2 when EL2 is enabled in the current Security state.</p>
<p>Reading the <a href="AArch64-dczid_el0.html">DCZID_EL0</a> returns a value that indicates that the instructions this trap applies to are not supported.</p></td></tr></table>
      <p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-27_27">TGE, bit [27]</h4><div class="field">
      <p>Trap General Exceptions, from EL0.</p>
    <table class="valuetable"><tr><th>TGE</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control has no effect on execution at EL0.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td><p>When EL2 is not enabled in the current Security state, this control has no effect on execution at EL0.</p>
<p>When EL2 is enabled in the current Security state, in all cases:</p>
<ul>
<li>All exceptions that would be routed to EL1 are routed to EL2.
</li><li>If EL1 is using AArch64, the <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.M field is treated as being 0 for all purposes other than returning the result of a direct read of <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.
</li><li>If EL1 is using AArch32, the <a href="AArch32-sctlr.html">SCTLR</a>.M field is treated as being 0 for all purposes other than returning the result of a direct read of <a href="AArch32-sctlr.html">SCTLR</a>.
</li><li>All virtual interrupts are disabled.
</li><li>Any <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> mechanisms for signaling virtual interrupts are disabled.
</li><li>An exception return to EL1 is treated as an illegal exception return.
</li><li>The <a href="AArch64-mdcr_el2.html">MDCR_EL2</a>.{TDRA, TDOSA, TDA, TDE} fields are treated as being 1 for all purposes other than returning the result of a direct read of <a href="AArch64-mdcr_el2.html">MDCR_EL2</a>.
</li></ul>
<p>In addition, when EL2 is enabled in the current Security state, if:</p>
<ul>
<li>HCR_EL2.E2H is 0, the Effective values of the HCR_EL2.{FMO, IMO, AMO} fields are 1.
</li><li>HCR_EL2.E2H is 1, the Effective values of the HCR_EL2.{FMO, IMO, AMO} fields are 0.
</li></ul>
<p>For further information on the behavior of this bit when E2H is 1, see <span class="xref">'Behavior of HCR_EL2.E2H'</span>.</p></td></tr></table>
      <p>HCR_EL2.TGE must not be cached in a TLB.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-26_26">TVM, bit [26]</h4><div class="field"><p>Trap Virtual Memory controls. Traps writes to the virtual memory control registers to EL2, when EL2 is enabled in the current Security state, as follows:</p>
<ul>
<li>
<p>If EL1 is using AArch64 state, the following registers are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x18</span> for <span class="instruction">MSR</span> and <span class="hexnumber">0x14</span> for <span class="instruction">MSRR</span>:</p>
<ul>
<li>
<p><a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>, <a href="AArch64-ttbr0_el1.html">TTBR0_EL1</a>, <a href="AArch64-ttbr1_el1.html">TTBR1_EL1</a>, <a href="AArch64-tcr_el1.html">TCR_EL1</a>, <a href="AArch64-esr_el1.html">ESR_EL1</a>, <a href="AArch64-far_el1.html">FAR_EL1</a>, <a href="AArch64-afsr0_el1.html">AFSR0_EL1</a>, <a href="AArch64-afsr1_el1.html">AFSR1_EL1</a>, <a href="AArch64-mair_el1.html">MAIR_EL1</a>, <a href="AArch64-amair_el1.html">AMAIR_EL1</a>, <a href="AArch64-contextidr_el1.html">CONTEXTIDR_EL1</a>.</p>

</li><li>
<p>If FEAT_AIE is implemented, <a href="AArch64-mair2_el1.html">MAIR2_EL1</a>, <a href="AArch64-amair2_el1.html">AMAIR2_EL1</a>.</p>

</li><li>
<p>If FEAT_S1PIE is implemented, <a href="AArch64-pire0_el1.html">PIRE0_EL1</a>, <a href="AArch64-pir_el1.html">PIR_EL1</a>.</p>

</li><li>
<p>If FEAT_S1POE is implemented, <a href="AArch64-por_el0.html">POR_EL0</a>, <a href="AArch64-por_el1.html">POR_EL1</a>.</p>

</li><li>
<p>If FEAT_S2POE is implemented, <a href="AArch64-s2por_el1.html">S2POR_EL1</a>.</p>

</li><li>
<p>If FEAT_TCR2 is implemented, <a href="AArch64-tcr2_el1.html">TCR2_EL1</a>.</p>

</li><li>
<p>If FEAT_SCTLR2 is implemented, <a href="AArch64-sctlr2_el1.html">SCTLR2_EL1</a>.</p>

</li></ul>

</li><li>
<p>If HCR_EL2.{E2H, TGE} is not {1, 1}, and EL0 is using AArch64 state, EL0 accesses to the following registers are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x18</span> for <span class="instruction">MSR</span>:</p>
<ul>
<li>If FEAT_S1POE is implemented, <a href="AArch64-por_el0.html">POR_EL0</a>.
</li></ul>

</li><li>
<p>If EL1 is using AArch32 state, EL1 accesses using MCR to the following registers are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x03</span>, accesses using MCRR are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x04</span>:</p>
<ul>
<li><a href="AArch32-sctlr.html">SCTLR</a>, <a href="AArch32-ttbr0.html">TTBR0</a>, <a href="AArch32-ttbr1.html">TTBR1</a>, <a href="AArch32-ttbcr.html">TTBCR</a>, <a href="AArch32-ttbcr2.html">TTBCR2</a>, <a href="AArch32-dacr.html">DACR</a>, <a href="AArch32-dfsr.html">DFSR</a>, <a href="AArch32-ifsr.html">IFSR</a>, <a href="AArch32-dfar.html">DFAR</a>, <a href="AArch32-ifar.html">IFAR</a>, <a href="AArch32-adfsr.html">ADFSR</a>, <a href="AArch32-aifsr.html">AIFSR</a>, <a href="AArch32-prrr.html">PRRR</a>, <a href="AArch32-nmrr.html">NMRR</a>, <a href="AArch32-mair0.html">MAIR0</a>, <a href="AArch32-mair1.html">MAIR1</a>, <a href="AArch32-amair0.html">AMAIR0</a>, <a href="AArch32-amair1.html">AMAIR1</a>, <a href="AArch32-contextidr.html">CONTEXTIDR</a>.
</li></ul>

</li></ul><table class="valuetable"><tr><th>TVM</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Write accesses to the specified Virtual Memory control registers are trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr></table>
      <p>When HCR_EL2.{E2H, TGE} is {1, 1}, the PE ignores the value of this field for all purposes other than a direct read of this field.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-25_25">TTLB, bit [25]</h4><div class="field"><p>Trap TLB maintenance instructions. Traps EL1 execution of TLB maintenance instructions to EL2, when EL2 is enabled in the current Security state, as follows:</p>
<ul>
<li>
<p>When EL1 is using AArch64 state, the following instructions are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x18</span>:</p>
<ul>
<li><a href="AArch64-tlbi-vmalle1.html">TLBI VMALLE1</a>, <a href="AArch64-tlbi-vae1.html">TLBI VAE1</a>, <a href="AArch64-tlbi-aside1.html">TLBI ASIDE1</a>, <a href="AArch64-tlbi-vaae1.html">TLBI VAAE1</a>, <a href="AArch64-tlbi-vale1.html">TLBI VALE1</a>, <a href="AArch64-tlbi-vaale1.html">TLBI VAALE1</a>.
</li><li><a href="AArch64-tlbi-vmalle1is.html">TLBI VMALLE1IS</a>, <a href="AArch64-tlbi-vae1is.html">TLBI VAE1IS</a>, <a href="AArch64-tlbi-aside1is.html">TLBI ASIDE1IS</a>, <a href="AArch64-tlbi-vaae1is.html">TLBI VAAE1IS</a>, <a href="AArch64-tlbi-vale1is.html">TLBI VALE1IS</a>, <a href="AArch64-tlbi-vaale1is.html">TLBI VAALE1IS</a>.
</li><li>If <span class="xref">FEAT_TLBIOS</span> is implemented, this trap applies to <a href="AArch64-tlbi-vmalle1os.html">TLBI VMALLE1OS</a>, <a href="AArch64-tlbi-vae1os.html">TLBI VAE1OS</a>, <a href="AArch64-tlbi-aside1os.html">TLBI ASIDE1OS</a>, <a href="AArch64-tlbi-vaae1os.html">TLBI VAAE1OS</a>, <a href="AArch64-tlbi-vale1os.html">TLBI VALE1OS</a>, <a href="AArch64-tlbi-vaale1os.html">TLBI VAALE1OS</a>.
</li><li>If <span class="xref">FEAT_TLBIRANGE</span> is implemented, this trap applies to <a href="AArch64-tlbi-rvae1.html">TLBI RVAE1</a>, <a href="AArch64-tlbi-rvaae1.html">TLBI RVAAE1</a>, <a href="AArch64-tlbi-rvale1.html">TLBI RVALE1</a>, <a href="AArch64-tlbi-rvaale1.html">TLBI RVAALE1</a>, <a href="AArch64-tlbi-rvae1is.html">TLBI RVAE1IS</a>, <a href="AArch64-tlbi-rvaae1is.html">TLBI RVAAE1IS</a>, <a href="AArch64-tlbi-rvale1is.html">TLBI RVALE1IS</a>, <a href="AArch64-tlbi-rvaale1is.html">TLBI RVAALE1IS</a>.
</li><li>If <span class="xref">FEAT_TLBIOS</span> and <span class="xref">FEAT_TLBIRANGE</span> are implemented, this trap applies to <a href="AArch64-tlbi-rvae1os.html">TLBI RVAE1OS</a>, <a href="AArch64-tlbi-rvaae1os.html">TLBI RVAAE1OS</a>, <a href="AArch64-tlbi-rvale1os.html">TLBI RVALE1OS</a>, <a href="AArch64-tlbi-rvaale1os.html">TLBI RVAALE1OS</a>.
</li></ul>

</li><li>
<p>When EL1 is using AArch32 state, the following instructions are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x03</span>:</p>
<ul>
<li><a href="AArch32-tlbiallis.html">TLBIALLIS</a>, <a href="AArch32-tlbimvais.html">TLBIMVAIS</a>, <a href="AArch32-tlbiasidis.html">TLBIASIDIS</a>, <a href="AArch32-tlbimvaais.html">TLBIMVAAIS</a>, <a href="AArch32-tlbimvalis.html">TLBIMVALIS</a>, <a href="AArch32-tlbimvaalis.html">TLBIMVAALIS</a>.
</li><li><a href="AArch32-tlbiall.html">TLBIALL</a>, <a href="AArch32-tlbimva.html">TLBIMVA</a>, <a href="AArch32-tlbiasid.html">TLBIASID</a>, <a href="AArch32-tlbimvaa.html">TLBIMVAA</a>, <a href="AArch32-tlbimval.html">TLBIMVAL</a>, <a href="AArch32-tlbimvaal.html">TLBIMVAAL</a>
</li><li><a href="AArch32-itlbiall.html">ITLBIALL</a>, <a href="AArch32-itlbimva.html">ITLBIMVA</a>, <a href="AArch32-itlbiasid.html">ITLBIASID</a>.
</li><li><a href="AArch32-dtlbiall.html">DTLBIALL</a>, <a href="AArch32-dtlbimva.html">DTLBIMVA</a>, <a href="AArch32-dtlbiasid.html">DTLBIASID</a>.
</li></ul>

</li></ul><table class="valuetable"><tr><th>TTLB</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>EL1 execution of the specified TLB maintenance instructions are trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr></table><p>When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.</p>
<div class="note"><span class="note-header">Note</span><p>The TLB maintenance instructions are <span class="arm-defined-word">UNDEFINED</span> at EL0.</p></div><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-24_24">TPU, bit [24]</h4><div class="field"><p>Trap cache maintenance instructions that operate to the Point of Unification. Traps execution of those cache maintenance instructions to EL2, when EL2 is enabled in the current Security state as follows:</p>
<ul>
<li>If EL0 is using AArch64 state and the value of <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.UCI is not 0, the following instructions are trapped to EL2 and reported with EC syndrome value <span class="hexnumber">0x18</span>:<ul>
<li><a href="AArch64-ic-ivau.html">IC IVAU</a>, <a href="AArch64-dc-cvau.html">DC CVAU</a>. If the value of <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.UCI is 0 these instructions are <span class="arm-defined-word">UNDEFINED</span> at EL0 and any resulting exception is higher priority than this trap to EL2.
</li></ul>

</li><li>If EL1 is using AArch64 state, the following instructions are trapped to EL2 and reported with EC syndrome value <span class="hexnumber">0x18</span>:<ul>
<li><a href="AArch64-ic-ivau.html">IC IVAU</a>, <a href="AArch64-ic-iallu.html">IC IALLU</a>, <a href="AArch64-ic-ialluis.html">IC IALLUIS</a>, <a href="AArch64-dc-cvau.html">DC CVAU</a>.
</li></ul>

</li><li>If EL1 is using AArch32 state, the following instructions are trapped to EL2 and reported with EC syndrome value <span class="hexnumber">0x18</span>:<ul>
<li><a href="AArch32-icimvau.html">ICIMVAU</a>, <a href="AArch32-iciallu.html">ICIALLU</a>, <a href="AArch32-icialluis.html">ICIALLUIS</a>, <a href="AArch32-dccmvau.html">DCCMVAU</a>.
</li></ul>

</li></ul>
<div class="note"><span class="note-header">Note</span><p>An exception generated because an instruction is <span class="arm-defined-word">UNDEFINED</span> at EL0 is higher priority than this trap to EL2. In addition:</p><ul><li><a href="AArch64-ic-ialluis.html">IC IALLUIS</a> and <a href="AArch64-ic-iallu.html">IC IALLU</a> are always <span class="arm-defined-word">UNDEFINED</span> at EL0 using AArch64.</li><li><a href="AArch32-icimvau.html">ICIMVAU</a>, <a href="AArch32-iciallu.html">ICIALLU</a>, <a href="AArch32-icialluis.html">ICIALLUIS</a>, and <a href="AArch32-dccmvau.html">DCCMVAU</a> are always <span class="arm-defined-word">UNDEFINED</span> at EL0 using AArch32.</li></ul></div><table class="valuetable"><tr><th>TPU</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Execution of the specified instructions is trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr></table><p>If the Point of Unification is before any level of data cache, it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether the execution of any data or unified cache clean by VA to the Point of Unification instruction can be trapped when the value of this control is 1.</p>
<p>If the Point of Unification is before any level of instruction cache, it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether the execution of any instruction cache invalidate to the Point of Unification instruction can be trapped when the value of this control is 1.</p>
<p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-23_23-1">Bit[23]<span class="condition"><br/>When FEAT_DPB is implemented:
                        </span></h4><h5>TPCP, bit 
                        [23]</h5><div class="field"><p>Trap data or unified cache maintenance instructions that operate to the Point of Coherency or Persistence. Traps execution of those cache maintenance instructions to EL2, when EL2 is enabled in the current Security state as follows:</p>
<ul>
<li>If EL0 is using AArch64 state and the value of <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.UCI is not 0, the following instructions are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x18</span>:<ul>
<li><a href="AArch64-dc-civac.html">DC CIVAC</a>, <a href="AArch64-dc-cvac.html">DC CVAC</a>, <a href="AArch64-dc-cvap.html">DC CVAP</a>. If the value of <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.UCI is 0 these instructions are <span class="arm-defined-word">UNDEFINED</span> at EL0 and any resulting exception is higher priority than this trap to EL2.
</li></ul>

</li><li>If EL1 is using AArch64 state, the following instructions are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x18</span>:<ul>
<li><a href="AArch64-dc-ivac.html">DC IVAC</a>, <a href="AArch64-dc-civac.html">DC CIVAC</a>, <a href="AArch64-dc-cvac.html">DC CVAC</a>, <a href="AArch64-dc-cvap.html">DC CVAP</a>.
</li></ul>

</li><li>If EL1 is using AArch32 state, the following instructions are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x03</span>:<ul>
<li><a href="AArch32-dcimvac.html">DCIMVAC</a>, <a href="AArch32-dccimvac.html">DCCIMVAC</a>, <a href="AArch32-dccmvac.html">DCCMVAC</a>.
</li></ul>

</li></ul>
<p>If <span class="xref">FEAT_DPB2</span> is implemented, this trap also applies to <a href="AArch64-dc-cvadp.html">DC CVADP</a>.</p>
<p>If <span class="xref">FEAT_MTE</span> is implemented, this trap also applies to <a href="AArch64-dc-cigvac.html">DC CIGVAC</a>, <a href="AArch64-dc-cigdvac.html">DC CIGDVAC</a>, <a href="AArch64-dc-igvac.html">DC IGVAC</a>, <a href="AArch64-dc-igdvac.html">DC IGDVAC</a>, <a href="AArch64-dc-cgvac.html">DC CGVAC</a>, <a href="AArch64-dc-cgdvac.html">DC CGDVAC</a>, <a href="AArch64-dc-cgvap.html">DC CGVAP</a> and <a href="AArch64-dc-cgdvap.html">DC CGDVAP</a>.</p>
<p>If <span class="xref">FEAT_DPB2</span> and <span class="xref">FEAT_MTE</span> are implemented, this trap also applies to <a href="AArch64-dc-cgvadp.html">DC CGVADP</a> and <a href="AArch64-dc-cgdvadp.html">DC CGDVADP</a>.</p>
<div class="note"><span class="note-header">Note</span><ul><li>An exception generated because an instruction is <span class="arm-defined-word">UNDEFINED</span> at EL0 is higher priority than this trap to EL2. In addition:<ul><li>AArch64 instructions which invalidate by VA to the Point of Coherency are always <span class="arm-defined-word">UNDEFINED</span> at EL0 using AArch64.</li><li><a href="AArch32-dcimvac.html">DCIMVAC</a>, <a href="AArch32-dccimvac.html">DCCIMVAC</a>, and <a href="AArch32-dccmvac.html">DCCMVAC</a> are always <span class="arm-defined-word">UNDEFINED</span> at EL0 using AArch32.</li></ul></li><li>In Armv8.0 and Armv8.1, this field is named TPC. From Armv8.2, it is named TPCP.</li></ul></div><table class="valuetable"><tr><th>TPCP</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Execution of the specified instructions is trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr></table><p>If the Point of Coherency is before any level of data cache, it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether the execution of any data or unified cache clean, invalidate, or clean and invalidate instruction that operates by VA to the point of coherency can be trapped when the value of this control is 1.</p>
<p>If HCR_EL2.{E2H, TGE} is set to {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-23_23-2"><span class="condition"><br/>Otherwise:
                        </span></h4><h5>TPC, bit 
                        [23]</h5><div class="field"><p>Trap data or unified cache maintenance instructions that operate to the Point of Coherency. Traps execution of those cache maintenance instructions to EL2, when EL2 is enabled in the current Security state as follows:</p>
<ul>
<li>If EL0 is using AArch64 state and the value of <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.UCI is not 0, accesses to the following registers are trapped and reported using EC syndrome value <span class="hexnumber">0x18</span>:<ul>
<li><a href="AArch64-dc-civac.html">DC CIVAC</a>, <a href="AArch64-dc-cvac.html">DC CVAC</a>. However, if the value of <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.UCI is 0 these instructions are <span class="arm-defined-word">UNDEFINED</span> at EL0 and any resulting exception is higher priority than this trap to EL2.
</li></ul>

</li><li>If EL1 is using AArch64 state, accesses to <a href="AArch64-dc-ivac.html">DC IVAC</a>, <a href="AArch64-dc-civac.html">DC CIVAC</a>, <a href="AArch64-dc-cvac.html">DC CVAC</a> are trapped and reported using EC syndrome value <span class="hexnumber">0x18</span>.
</li><li>When EL1 is using AArch32, accesses to <a href="AArch32-dcimvac.html">DCIMVAC</a>, <a href="AArch32-dccimvac.html">DCCIMVAC</a>, and <a href="AArch32-dccmvac.html">DCCMVAC</a> are trapped and reported using EC syndrome value <span class="hexnumber">0x03</span>.
</li></ul>
<div class="note"><span class="note-header">Note</span><ul><li>An exception generated because an instruction is <span class="arm-defined-word">UNDEFINED</span> at EL0 is higher priority than this trap to EL2. In addition:<ul><li>AArch64 instructions which invalidate by VA to the Point of Coherency are always <span class="arm-defined-word">UNDEFINED</span> at EL0 using AArch64.</li><li><a href="AArch32-dcimvac.html">DCIMVAC</a>, <a href="AArch32-dccimvac.html">DCCIMVAC</a>, and <a href="AArch32-dccmvac.html">DCCMVAC</a> are always <span class="arm-defined-word">UNDEFINED</span> at EL0 using AArch32.</li></ul></li><li>In Armv8.0 and Armv8.1, this field is named TPC. From Armv8.2, it is named TPCP.</li></ul></div><table class="valuetable"><tr><th>TPC</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Execution of the specified instructions is trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr></table><p>If the Point of Coherency is before any level of data cache, it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether the execution of any data or unified cache clean, invalidate, or clean and invalidate instruction that operates by VA to the point of coherency can be trapped when the value of this control is 1.</p>
<p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-22_22">TSW, bit [22]</h4><div class="field"><p>Trap data or unified cache maintenance instructions that operate by Set/Way. Traps execution of those cache maintenance instructions at EL1 to EL2, when EL2 is enabled in the current Security state as follows:</p>
<ul>
<li>If EL1 is using AArch64 state, accesses to <a href="AArch64-dc-isw.html">DC ISW</a>, <a href="AArch64-dc-csw.html">DC CSW</a>, <a href="AArch64-dc-cisw.html">DC CISW</a> are trapped to EL2, reported using EC syndrome value <span class="hexnumber">0x18</span>.
</li><li>If EL1 is using AArch32 state, accesses to <a href="AArch32-dcisw.html">DCISW</a>, <a href="AArch32-dccsw.html">DCCSW</a>, <a href="AArch32-dccisw.html">DCCISW</a> are trapped to EL2, reported using EC syndrome value <span class="hexnumber">0x03</span>.
</li></ul>
<p>If <span class="xref">FEAT_MTE2</span> is implemented, this trap also applies to <a href="AArch64-dc-igsw.html">DC IGSW</a>, <a href="AArch64-dc-igdsw.html">DC IGDSW</a>, <a href="AArch64-dc-cgsw.html">DC CGSW</a>, <a href="AArch64-dc-cgdsw.html">DC CGDW</a>, <a href="AArch64-dc-cigsw.html">DC CIGSW</a>, and <a href="AArch64-dc-cigdsw.html">DC CIGDSW</a>.</p>
<div class="note"><span class="note-header">Note</span><p>An exception generated because an instruction is <span class="arm-defined-word">UNDEFINED</span> at EL0 is higher priority than this trap to EL2, and these instructions are always <span class="arm-defined-word">UNDEFINED</span> at EL0.</p></div><table class="valuetable"><tr><th>TSW</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Execution of the specified instructions is trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr></table>
      <p>When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-21_21">TACR, bit [21]</h4><div class="field"><p>Trap Auxiliary Control Registers. Traps EL1 accesses to the Auxiliary Control Registers to EL2, when EL2 is enabled in the current Security state, as follows:</p>
<ul>
<li>If EL1 is using AArch64 state, accesses to <a href="AArch64-actlr_el1.html">ACTLR_EL1</a> to EL2, are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x18</span>.
</li><li>If EL1 is using AArch32 state, accesses to <a href="AArch32-actlr.html">ACTLR</a> and, if implemented, <a href="AArch32-actlr2.html">ACTLR2</a> are trapped to EL2 and reported using EC syndrome value <span class="hexnumber">0x03</span>.
</li></ul><table class="valuetable"><tr><th>TACR</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>EL1 accesses to the specified registers are trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr></table><p>When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.</p>
<div class="note"><span class="note-header">Note</span><p><a href="AArch64-actlr_el1.html">ACTLR_EL1</a> is not accessible at EL0.</p><p><a href="AArch32-actlr.html">ACTLR</a> and <a href="AArch32-actlr2.html">ACTLR2</a> are not accessible at EL0.</p><p>The Auxiliary Control Registers are <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> registers that might implement global control bits for the PE.</p></div><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-20_20">TIDCP, bit [20]</h4><div class="field"><p>Trap <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> functionality. Traps EL1 accesses to the encodings reserved for <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> functionality to EL2, when EL2 is enabled in the current Security state as follows:</p>
<ul>
<li>In AArch64 state, access to any of the encodings in the following reserved encoding spaces are trapped and reported using EC syndrome <span class="hexnumber">0x18</span>:<ul>
<li><span class="arm-defined-word">IMPLEMENTATION DEFINED</span> System instructions, which are accessed using SYS and SYSL, with CRn == {11, 15}.
</li><li><span class="arm-defined-word">IMPLEMENTATION DEFINED</span> System registers, which are accessed using MRS and MSR with the <a href="AArch64-s3_op1_cn_cm_op2.html">S3_&lt;op1&gt;_&lt;Cn&gt;_&lt;Cm&gt;_&lt;op2&gt;</a> register name.
</li></ul>

</li><li>In AArch32 state, MCR and MRC access to instructions with the following encodings are trapped and reported using EC syndrome <span class="hexnumber">0x03</span>:<ul>
<li>All coproc==p15, CRn==c9, opc1 == {0-7}, CRm == {c0-c2, c5-c8}, opc2 == {0-7}.
</li><li>All coproc==p15, CRn==c10, opc1 =={0-7}, CRm == {c0, c1, c4, c8}, opc2 == {0-7}.
</li><li>All coproc==p15, CRn==c11, opc1=={0-7}, CRm == {c0-c8, c15}, opc2 == {0-7}.
</li></ul>

</li></ul>
<p>When this functionality is accessed from EL0:</p>
<ul>
<li>
<p>If <span class="xref">FEAT_TIDCP1</span> is implemented and the Effective value of <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.TIDCP is 1, any accesses from EL0 are trapped to EL1.</p>

</li><li>
<p>Otherwise, if <span class="xref">FEAT_TIDCP1</span> is implemented and the Effective value of <a href="AArch64-sctlr_el2.html">SCTLR_EL2</a>.TIDCP is 1, any accesses from EL0 are trapped to EL2.</p>

</li><li>
<p>Otherwise:</p>
<ul>
<li>
<p>If HCR_EL2.TIDCP is 1, it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether any accesses from EL0 are trapped to EL2.</p>

</li><li>
<p>If HCR_EL2.TIDCP is 0, any accesses from EL0 are <span class="arm-defined-word">UNDEFINED</span> and generate an exception that is taken to EL1 or EL2.</p>

</li></ul>

</li></ul><table class="valuetable"><tr><th>TIDCP</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>EL1 accesses to or execution of the specified encodings reserved for <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> functionality are trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr></table><p>An implementation can also include <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> registers that provide additional controls, to give finer-grained control of the trapping of <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> features.</p>
<div class="note"><span class="note-header">Note</span><p>The trapping of accesses to these registers from EL1 is higher priority than an exception resulting from the register access being <span class="arm-defined-word">UNDEFINED</span>.</p></div><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-19_19">TSC, bit [19]</h4><div class="field"><p>Trap <span class="instruction">SMC</span> instructions. Traps EL1 execution of <span class="instruction">SMC</span> instructions to EL2, when EL2 is enabled in the current Security state.</p>
<p>If execution is in AArch64 state, the trap is reported using EC syndrome value <span class="hexnumber">0x17</span>.</p>
<p>If execution is in AArch32 state, the trap is reported using EC syndrome value <span class="hexnumber">0x13</span>.</p>
<div class="note"><span class="note-header">Note</span><p>HCR_EL2.TSC traps execution of the <span class="instruction">SMC</span> instruction. It is not a routing control for the <span class="instruction">SMC</span> exception. Trap exceptions and <span class="instruction">SMC</span> exceptions have different preferred return addresses.</p></div><table class="valuetable"><tr><th>TSC</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td><p>If EL3 is implemented, then any attempt to execute an <span class="instruction">SMC</span> instruction at EL1 is trapped to EL2, when EL2 is enabled in the current Security state, regardless of the value of <a href="AArch64-scr_el3.html">SCR_EL3</a>.SMD.</p>
<p>If EL3 is not implemented, <span class="xref">FEAT_NV</span> is implemented, and HCR_EL2.NV is 1, then any attempt to execute an SMC instruction at EL1 using AArch64 is trapped to EL2, when EL2 is enabled in the current Security state.</p>
<p>If EL3 is not implemented, and either <span class="xref">FEAT_NV</span> is not implemented or HCR_EL2.NV is 0, then it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether:</p>
<ul>
<li>Any attempt to execute an SMC instruction at EL1 is trapped to EL2, when EL2 is enabled in the current Security state.
</li><li>Any attempt to execute an SMC instruction is <span class="arm-defined-word">UNDEFINED</span>.
</li></ul></td></tr></table><p>In AArch32 state, the Armv8-A architecture permits, but does not require, this trap to apply to conditional <span class="instruction">SMC</span> instructions that fail their condition code check, in the same way as with traps on other conditional instructions.</p>
<p><span class="instruction">SMC</span> instructions are <span class="arm-defined-word">UNDEFINED</span> at EL0.</p>
<p>If EL3 is not implemented, and either <span class="xref">FEAT_NV</span> is not implemented or HCR_EL2.NV is 0, then it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether this bit is:</p>
<ul>
<li><span class="arm-defined-word">RES0</span>.
</li><li>Implemented with the functionality as described in HCR_EL2.TSC.
</li></ul>
<p>When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-18_18">TID3, bit [18]</h4><div class="field"><p>Trap ID group 3. Traps EL1 reads of group 3 ID registers to EL2, when EL2 is enabled in the current Security state, as follows:</p>
<p>In AArch64 state:</p>
<ul>
<li>
<p>Reads of the following registers are trapped to EL2, reported using EC syndrome value <span class="hexnumber">0x18</span>:</p>
<ul>
<li>
<p><a href="AArch64-id_pfr0_el1.html">ID_PFR0_EL1</a>, <a href="AArch64-id_pfr1_el1.html">ID_PFR1_EL1</a>, <a href="AArch64-id_dfr0_el1.html">ID_DFR0_EL1</a>, <a href="AArch64-id_afr0_el1.html">ID_AFR0_EL1</a>, <a href="AArch64-id_mmfr0_el1.html">ID_MMFR0_EL1</a>, <a href="AArch64-id_mmfr1_el1.html">ID_MMFR1_EL1</a>, <a href="AArch64-id_mmfr2_el1.html">ID_MMFR2_EL1</a>, <a href="AArch64-id_mmfr3_el1.html">ID_MMFR3_EL1</a>, <a href="AArch64-id_isar0_el1.html">ID_ISAR0_EL1</a>, <a href="AArch64-id_isar1_el1.html">ID_ISAR1_EL1</a>, <a href="AArch64-id_isar2_el1.html">ID_ISAR2_EL1</a>, <a href="AArch64-id_isar3_el1.html">ID_ISAR3_EL1</a>, <a href="AArch64-id_isar4_el1.html">ID_ISAR4_EL1</a>, <a href="AArch64-id_isar5_el1.html">ID_ISAR5_EL1</a>, <a href="AArch64-mvfr0_el1.html">MVFR0_EL1</a>, <a href="AArch64-mvfr1_el1.html">MVFR1_EL1</a>, <a href="AArch64-mvfr2_el1.html">MVFR2_EL1</a>.</p>

</li><li>
<p><a href="AArch64-id_aa64pfr0_el1.html">ID_AA64PFR0_EL1</a>, <a href="AArch64-id_aa64pfr1_el1.html">ID_AA64PFR1_EL1</a>, <a href="AArch64-id_aa64dfr0_el1.html">ID_AA64DFR0_EL1</a>, <a href="AArch64-id_aa64dfr1_el1.html">ID_AA64DFR1_EL1</a>, <a href="AArch64-id_aa64isar0_el1.html">ID_AA64ISAR0_EL1</a>, <a href="AArch64-id_aa64isar1_el1.html">ID_AA64ISAR1_EL1</a>, <a href="AArch64-id_aa64mmfr0_el1.html">ID_AA64MMFR0_EL1</a>, <a href="AArch64-id_aa64mmfr1_el1.html">ID_AA64MMFR1_EL1</a>, <a href="AArch64-id_aa64afr0_el1.html">ID_AA64AFR0_EL1</a>, <a href="AArch64-id_aa64afr1_el1.html">ID_AA64AFR1_EL1</a>.</p>

</li><li>
<p>If <span class="xref">FEAT_FGT</span> is implemented, reads of the following registers are trapped to EL2. If FEAT_FGT is not implemented, reads of the following registers are trapped to EL2, unless the registers are implemented as RAZ, when it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether accesses are trapped to EL2.</p>
<ul>
<li>
<p><a href="AArch64-id_pfr2_el1.html">ID_PFR2_EL1</a>, <a href="AArch64-id_mmfr4_el1.html">ID_MMFR4_EL1</a> and <a href="AArch64-id_mmfr5_el1.html">ID_MMFR5_EL1</a>.</p>

</li><li>
<p><a href="AArch64-id_aa64mmfr3_el1.html">ID_AA64MMFR3_EL1</a>.</p>

</li><li>
<p><a href="AArch64-id_aa64mmfr4_el1.html">ID_AA64MMFR4_EL1</a>.</p>

</li><li>
<p><a href="AArch64-id_aa64pfr2_el1.html">ID_AA64PFR2_EL1</a>.</p>

</li><li>
<p><a href="AArch64-id_aa64mmfr2_el1.html">ID_AA64MMFR2_EL1</a> and <a href="AArch64-id_isar6_el1.html">ID_ISAR6_EL1</a>.</p>

</li><li>
<p><a href="AArch64-id_dfr1_el1.html">ID_DFR1_EL1</a>.</p>

</li><li>
<p><a href="AArch64-id_aa64zfr0_el1.html">ID_AA64ZFR0_EL1</a>.</p>

</li><li>
<p><a href="AArch64-id_aa64smfr0_el1.html">ID_AA64SMFR0_EL1</a>.</p>

</li><li>
<p><a href="AArch64-id_aa64isar2_el1.html">ID_AA64ISAR2_EL1</a>.</p>

</li></ul>

</li><li>
<p>If <span class="xref">FEAT_FGT</span> is implemented, this field traps all MRS accesses to registers in the following range that are not already mentioned in this field description: op0 == 3, op1 == 0, CRn == 0, CRm == {2-7}, op2 == {0-7}. If FEAT_FGT is not implemented, it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether this field traps accesses to registers in the range.</p>

</li></ul>

</li></ul>
<p>In AArch32 state:</p>
<ul>
<li>
<p>VMRS access to <a href="AArch32-mvfr0.html">MVFR0</a>, <a href="AArch32-mvfr1.html">MVFR1</a>, and <a href="AArch32-mvfr2.html">MVFR2</a>, are trapped to EL2, reported using EC syndrome value <span class="hexnumber">0x08</span>, unless access is also trapped by <a href="AArch32-hcptr.html">HCPTR</a> which takes priority.</p>

</li><li>
<p>MRC access to the following registers are trapped to EL2, reported using EC syndrome value <span class="hexnumber">0x03</span>:</p>
<ul>
<li>
<p><a href="AArch32-id_pfr0.html">ID_PFR0</a>, <a href="AArch32-id_pfr1.html">ID_PFR1</a>, <a href="AArch32-id_pfr2.html">ID_PFR2</a>, <a href="AArch32-id_dfr0.html">ID_DFR0</a>, <a href="AArch32-id_afr0.html">ID_AFR0</a>, <a href="AArch32-id_mmfr0.html">ID_MMFR0</a>, <a href="AArch32-id_mmfr1.html">ID_MMFR1</a>, <a href="AArch32-id_mmfr2.html">ID_MMFR2</a>, <a href="AArch32-id_mmfr3.html">ID_MMFR3</a>, <a href="AArch32-id_isar0.html">ID_ISAR0</a>, <a href="AArch32-id_isar1.html">ID_ISAR1</a>, <a href="AArch32-id_isar2.html">ID_ISAR2</a>, <a href="AArch32-id_isar3.html">ID_ISAR3</a>, <a href="AArch32-id_isar4.html">ID_ISAR4</a>, <a href="AArch32-id_isar5.html">ID_ISAR5</a>.</p>

</li><li>
<p>If <span class="xref">FEAT_FGT</span> is implemented:</p>
<ul>
<li>
<p><a href="AArch32-id_mmfr4.html">ID_MMFR4</a> and <a href="AArch32-id_mmfr5.html">ID_MMFR5</a>.</p>

</li><li>
<p><a href="AArch32-id_isar6.html">ID_ISAR6</a>.</p>

</li><li>
<p><a href="AArch32-id_dfr1.html">ID_DFR1</a>.</p>

</li><li>
<p>This field traps all MRC accesses to encodings in the following range that are not already mentioned in this field description: coproc == p15, opc1 == 0, CRn == c0, CRm == {c2-c7}, opc2 == {0-7}.</p>

</li></ul>

</li><li>
<p>If <span class="xref">FEAT_FGT</span> is not implemented:</p>
<ul>
<li>
<p><a href="AArch32-id_mmfr4.html">ID_MMFR4</a> and <a href="AArch32-id_mmfr5.html">ID_MMFR5</a> are trapped to EL2, unless implemented as RAZ, when it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether accesses to <a href="AArch32-id_mmfr4.html">ID_MMFR4</a> or <a href="AArch32-id_mmfr5.html">ID_MMFR5</a> are trapped.</p>

</li><li>
<p><a href="AArch32-id_isar6.html">ID_ISAR6</a> is trapped to EL2, unless implemented as RAZ, when it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether accesses to <a href="AArch32-id_isar6.html">ID_ISAR6</a> are trapped to EL2.</p>

</li><li>
<p><a href="AArch32-id_dfr1.html">ID_DFR1</a> is trapped to EL2, unless implemented as RAZ, when it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether accesses to <a href="AArch32-id_dfr1.html">ID_DFR1</a> are trapped to EL2.</p>

</li><li>
<p>Otherwise, it is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether this bit traps all MRC accesses to registers in the following range not already mentioned in this field description with coproc == p15, opc1 == 0, CRn == c0, CRm == {c2-c7}, opc2 == {0-7}.</p>

</li></ul>

</li></ul>

</li></ul><table class="valuetable"><tr><th>TID3</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>The specified EL1 read accesses to ID group 3 registers are trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr></table>
      <p>When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-17_17">TID2, bit [17]</h4><div class="field"><p>Trap ID group 2. Traps the following register accesses to EL2, when EL2 is enabled in the current Security state, as follows:</p>
<ul>
<li>If EL1 is using AArch64, reads of <a href="AArch64-ctr_el0.html">CTR_EL0</a>, <a href="AArch64-ccsidr_el1.html">CCSIDR_EL1</a>, <a href="AArch64-ccsidr2_el1.html">CCSIDR2_EL1</a>, <a href="AArch64-clidr_el1.html">CLIDR_EL1</a>, and <a href="AArch64-csselr_el1.html">CSSELR_EL1</a> are trapped to EL2, reported using EC syndrome value <span class="hexnumber">0x18</span>.
</li><li>If EL0 is using AArch64 and the value of <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.UCT is not 0, reads of <a href="AArch64-ctr_el0.html">CTR_EL0</a> are trapped to EL2, reported using EC syndrome value <span class="hexnumber">0x18</span>. If the value of <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.UCT is 0, then EL0 reads of <a href="AArch64-ctr_el0.html">CTR_EL0</a> are trapped to EL1 and the resulting exception takes precedence over this trap.
</li><li>If EL1 is using AArch64, writes to <a href="AArch64-csselr_el1.html">CSSELR_EL1</a> are trapped to EL2, reported using EC syndrome value <span class="hexnumber">0x18</span>.
</li><li>If EL1 is using AArch32, reads of <a href="AArch32-ctr.html">CTR</a>, <a href="AArch32-ccsidr.html">CCSIDR</a>, <a href="AArch32-ccsidr2.html">CCSIDR2</a>, <a href="AArch32-clidr.html">CLIDR</a>, and <a href="AArch32-csselr.html">CSSELR</a> are trapped to EL2, reported using EC syndrome value <span class="hexnumber">0x03</span>.
</li><li>If EL1 is using AArch32, writes to <a href="AArch32-csselr.html">CSSELR</a> are trapped to EL2, reported using EC syndrome value <span class="hexnumber">0x03</span>.
</li></ul><table class="valuetable"><tr><th>TID2</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>The specified EL1 and EL0 accesses to ID group 2 registers are trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr></table>
      <p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-16_16">TID1, bit [16]</h4><div class="field"><p>Trap ID group 1. Traps EL1 reads of the following registers to EL2, when EL2 is enabled in the current Security state as follows:</p>
<ul>
<li>
<p>In AArch64 state, accesses of <a href="AArch64-revidr_el1.html">REVIDR_EL1</a>, <a href="AArch64-aidr_el1.html">AIDR_EL1</a>, 
<a href="AArch64-smidr_el1.html">SMIDR_EL1</a>, 
reported using EC syndrome value <span class="hexnumber">0x18</span>.</p>

</li><li>
<p>In AArch32 state, accesses of <a href="AArch32-tcmtr.html">TCMTR</a>, <a href="AArch32-tlbtr.html">TLBTR</a>, <a href="AArch32-revidr.html">REVIDR</a>, <a href="AArch32-aidr.html">AIDR</a>, reported using EC syndrome value <span class="hexnumber">0x03</span>.</p>

</li></ul><table class="valuetable"><tr><th>TID1</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>The specified EL1 read accesses to ID group 1 registers are trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr></table>
      <p>When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-15_15-1">TID0, bit [15]<span class="condition"><br/>When AArch32 is supported:
                        </span></h4><div class="field"><p>Trap ID group 0. Traps the following register accesses to EL2:</p>
<ul>
<li>EL1 reads of the <a href="AArch32-jidr.html">JIDR</a>, reported using EC syndrome value <span class="hexnumber">0x05</span>.
</li><li>If the <a href="AArch32-jidr.html">JIDR</a> is RAZ from EL0, EL0 reads of the <a href="AArch32-jidr.html">JIDR</a>, reported using EC syndrome value <span class="hexnumber">0x05</span>.
</li><li>EL1 accesses using VMRS of the <a href="AArch32-fpsid.html">FPSID</a>, reported using EC syndrome value <span class="hexnumber">0x08</span>.
</li></ul>
<div class="note"><span class="note-header">Note</span><ul><li>It is <span class="arm-defined-word">IMPLEMENTATION DEFINED</span> whether the <a href="AArch32-jidr.html">JIDR</a> is RAZ or <span class="arm-defined-word">UNDEFINED</span> at EL0. If it is <span class="arm-defined-word">UNDEFINED</span> at EL0, then any resulting exception takes precedence over this trap.</li><li>The <a href="AArch32-fpsid.html">FPSID</a> is not accessible at EL0 using AArch32.</li><li>Writes to the <a href="AArch32-fpsid.html">FPSID</a> are ignored, and not trapped by this control.</li></ul></div><table class="valuetable"><tr><th>TID0</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>The specified EL1 read accesses to ID group 0 registers are trapped to EL2, when EL2 is enabled in the current Security state.</p>
        </td></tr></table>
      <p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-15_15-2"><span class="condition"><br/>Otherwise:
                        </span></h4><div class="field">
      <p>Reserved, <span class="arm-defined-word">RES0</span>.</p>
    </div><h4 id="fieldset_0-14_14">TWE, bit [14]</h4><div class="field"><p>Traps EL0 and EL1 execution of WFE instructions to EL2, when EL2 is enabled in the current Security state, from both Execution states, reported using EC syndrome value <span class="hexnumber">0x01</span>.</p>
<p>When <span class="xref">FEAT_WFxT</span> is implemented, this trap also applies to the WFET instruction.</p><table class="valuetable"><tr><th>TWE</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Any attempt to execute a WFE instruction at EL0 or EL1 is trapped to EL2, when EL2 is enabled in the current Security state, if the instruction would otherwise have caused the PE to enter a low-power state and it is not trapped by <a href="AArch32-sctlr.html">SCTLR</a>.nTWE or <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.nTWE.</p>
        </td></tr></table><p>In AArch32 state, the attempted execution of a conditional WFE instruction is trapped only if the instruction passes its condition code check.</p>
<div class="note"><span class="note-header">Note</span><p>Since a WFE can complete at any time, even without a Wakeup event, the traps on WFE are not guaranteed to be taken, even if the WFE is executed when there is no Wakeup event. The only guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken.</p></div><p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.</p>
<p>For more information about when WFE instructions can cause the PE to enter a low-power state, see <span class="xref">'Wait for Event mechanism and Send event'</span>.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-13_13">TWI, bit [13]</h4><div class="field"><p>Traps EL0 and EL1 execution of WFI instructions to EL2, when EL2 is enabled in the current Security state, from both Execution states, reported using EC syndrome value <span class="hexnumber">0x01</span>.</p>
<p>When <span class="xref">FEAT_WFxT</span> is implemented, this trap also applies to the WFIT instruction.</p><table class="valuetable"><tr><th>TWI</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control does not cause any instructions to be trapped.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Any attempt to execute a WFI instruction at EL0 or EL1 is trapped to EL2, when EL2 is enabled in the current Security state, if the instruction would otherwise have caused the PE to enter a low-power state and it is not trapped by <a href="AArch32-sctlr.html">SCTLR</a>.nTWI or <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.nTWI.</p>
        </td></tr></table><p>In AArch32 state, the attempted execution of a conditional WFI instruction is trapped only if the instruction passes its condition code check.</p>
<div class="note"><span class="note-header">Note</span><p>Since a WFI can complete at any time, even without a Wakeup event, the traps on WFI are not guaranteed to be taken, even if the WFI is executed when there is no Wakeup event. The only guarantee is that if the instruction does not complete in finite time in the absence of a Wakeup event, the trap will be taken.</p></div><p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.</p>
<p>For more information about when WFI instructions can cause the PE to enter a low-power state, see <span class="xref">'Wait for Interrupt'</span>.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-12_12">DC, bit [12]</h4><div class="field">
      <p>Default Cacheability.</p>
    <table class="valuetable"><tr><th>DC</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control has no effect on the EL1&amp;0 translation regime.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td><p>In any Security state:</p>
<ul>
<li>When EL1 is using AArch64, the PE behaves as if the value of the <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.M field is 0 for all purposes other than returning the value of a direct read of <a href="AArch64-sctlr_el1.html">SCTLR_EL1</a>.
</li><li>When EL1 is using AArch32, the PE behaves as if the value of the <a href="AArch32-sctlr.html">SCTLR</a>.M field is 0 for all purposes other than returning the value of a direct read of <a href="AArch32-sctlr.html">SCTLR</a>.
</li><li>The PE behaves as if the value of the HCR_EL2.VM field is 1 for all purposes other than returning the value of a direct read of HCR_EL2.
</li><li>The memory type produced by stage 1 of the EL1&amp;0 translation regime is Normal Non-Shareable, Inner Write-Back Read-Allocate Write-Allocate, Outer Write-Back Read-Allocate Write-Allocate.
</li></ul></td></tr></table><p>This field has no effect on the EL2, EL2&amp;0, and EL3 translation regimes.</p>
<p>This bit is permitted to be cached in a TLB.</p>
<p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this field.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-11_10">BSU, bits [11:10]</h4><div class="field">
      <p>Barrier Shareability upgrade. This field determines the minimum shareability domain that is applied to any barrier instruction executed from EL1 or EL0:</p>
    <table class="valuetable"><tr><th>BSU</th><th>Meaning</th></tr><tr><td class="bitfield">0b00</td><td>
          <p>No effect.</p>
        </td></tr><tr><td class="bitfield">0b01</td><td>
          <p>Inner Shareable.</p>
        </td></tr><tr><td class="bitfield">0b10</td><td>
          <p>Outer Shareable.</p>
        </td></tr><tr><td class="bitfield">0b11</td><td>
          <p>Full system.</p>
        </td></tr></table><p>This value is combined with the specified level of the barrier held in its instruction, using the same principles as combining the shareability attributes from two stages of address translation.</p>
<p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as <span class="binarynumber">0b00</span> for all purposes other than a direct read of the value of this bit.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-9_9">FB, bit [9]</h4><div class="field"><p>Force broadcast. Causes the following instructions to be broadcast within the Inner Shareable domain when executed from EL1:</p>
<p>AArch32: <a href="AArch32-bpiall.html">BPIALL</a>, <a href="AArch32-tlbiall.html">TLBIALL</a>, <a href="AArch32-tlbimva.html">TLBIMVA</a>, <a href="AArch32-tlbiasid.html">TLBIASID</a>, <a href="AArch32-dtlbiall.html">DTLBIALL</a>, <a href="AArch32-dtlbimva.html">DTLBIMVA</a>, <a href="AArch32-dtlbiasid.html">DTLBIASID</a>, <a href="AArch32-itlbiall.html">ITLBIALL</a>, <a href="AArch32-itlbimva.html">ITLBIMVA</a>, <a href="AArch32-itlbiasid.html">ITLBIASID</a>, <a href="AArch32-tlbimvaa.html">TLBIMVAA</a>, <a href="AArch32-iciallu.html">ICIALLU</a>, <a href="AArch32-tlbimval.html">TLBIMVAL</a>, <a href="AArch32-tlbimvaal.html">TLBIMVAAL</a>.</p>
<p>AArch64: <a href="AArch64-tlbi-vmalle1.html">TLBI VMALLE1</a>, <a href="AArch64-tlbi-vae1.html">TLBI VAE1</a>, <a href="AArch64-tlbi-aside1.html">TLBI ASIDE1</a>, <a href="AArch64-tlbi-vaae1.html">TLBI VAAE1</a>, <a href="AArch64-tlbi-vale1.html">TLBI VALE1</a>, <a href="AArch64-tlbi-vaale1.html">TLBI VAALE1</a>, <a href="AArch64-ic-iallu.html">IC IALLU</a>, <a href="AArch64-tlbi-rvae1.html">TLBI RVAE1</a>, <a href="AArch64-tlbi-rvaae1.html">TLBI RVAAE1</a>, <a href="AArch64-tlbi-rvale1.html">TLBI RVALE1</a>, <a href="AArch64-tlbi-rvaale1.html">TLBI RVAALE1</a>.</p><table class="valuetable"><tr><th>FB</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This field has no effect on the operation of the specified instructions.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>When one of the specified instruction is executed at EL1, the instruction is broadcast within the Inner Shareable shareability domain.</p>
        </td></tr></table>
      <p>When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-8_8">VSE, bit [8]</h4><div class="field">
      <p>Virtual SError interrupt.</p>
    <table class="valuetable"><tr><th>VSE</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This mechanism is not making a virtual SError interrupt pending.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>A virtual SError interrupt is pending because of this mechanism.</p>
        </td></tr></table>
      <p>The virtual SError interrupt is enabled only when the value of HCR_EL2.{TGE, AMO} is {0, 1}.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-7_7">VI, bit [7]</h4><div class="field">
      <p>Virtual IRQ Interrupt.</p>
    <table class="valuetable"><tr><th>VI</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This mechanism is not making a virtual IRQ pending.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>A virtual IRQ is pending because of this mechanism.</p>
        </td></tr></table>
      <p>The virtual IRQ is enabled only when the value of HCR_EL2.{TGE, IMO} is {0, 1}.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-6_6">VF, bit [6]</h4><div class="field">
      <p>Virtual FIQ Interrupt.</p>
    <table class="valuetable"><tr><th>VF</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This mechanism is not making a virtual FIQ pending.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>A virtual FIQ is pending because of this mechanism.</p>
        </td></tr></table>
      <p>The virtual FIQ is enabled only when the value of HCR_EL2.{TGE, FMO} is {0, 1}.</p>
    <p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-5_5">AMO, bit [5]</h4><div class="field">
      <p>Physical SError interrupt routing.</p>
    <table class="valuetable"><tr><th>AMO</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td><p>When executing at Exception levels below EL2, and EL2 is enabled in the current Security state:</p>
<ul>
<li>When the value of HCR_EL2.TGE is 0, Physical SError interrupts are not taken to EL2.
</li><li>When the value of HCR_EL2.TGE is 1, Physical SError interrupts are taken to EL2 unless they are routed to EL3.
</li><li>Virtual SError interrupts are disabled.
</li></ul></td></tr><tr><td class="bitfield">0b1</td><td><p>When executing at any Exception level, and EL2 is enabled in the current Security state:</p>
<ul>
<li>Physical SError interrupts are taken to EL2, unless they are routed to EL3.
</li><li>When the value of HCR_EL2.TGE is 0, then virtual SError interrupts are enabled.
</li></ul></td></tr></table><p>If EL2 is enabled in the current Security state and the value of HCR_EL2.TGE is 1:</p>
<ul>
<li>Regardless of the value of the AMO bit physical asynchronous External aborts and SError interrupts target EL2 unless they are routed to EL3.
</li><li>When <span class="xref">FEAT_VHE</span> is not implemented, or if HCR_EL2.E2H is 0, this field behaves as 1 for all purposes other than a direct read of the value of this bit.
</li><li>When <span class="xref">FEAT_VHE</span> is implemented and HCR_EL2.E2H is 1, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
</li></ul>
<p>For more information, see <span class="xref">'Asynchronous exception routing'</span>.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-4_4">IMO, bit [4]</h4><div class="field">
      <p>Physical IRQ Routing.</p>
    <table class="valuetable"><tr><th>IMO</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td><p>When executing at Exception levels below EL2, and EL2 is enabled in the current Security state:</p>
<ul>
<li>When the value of HCR_EL2.TGE is 0, Physical IRQ interrupts are not taken to EL2.
</li><li>When the value of HCR_EL2.TGE is 1, Physical IRQ interrupts are taken to EL2 unless they are routed to EL3.
</li><li>Virtual IRQ interrupts are disabled.
</li></ul></td></tr><tr><td class="bitfield">0b1</td><td><p>When executing at any Exception level, and EL2 is enabled in the current Security state:</p>
<ul>
<li>Physical IRQ interrupts are taken to EL2, unless they are routed to EL3.
</li><li>When the value of HCR_EL2.TGE is 0, then Virtual IRQ interrupts are enabled.
</li></ul></td></tr></table><p>If EL2 is enabled in the current Security state, and the value of HCR_EL2.TGE is 1:</p>
<ul>
<li>Regardless of the value of the IMO bit, physical IRQ Interrupts target EL2 unless they are routed to EL3.
</li><li>When <span class="xref">FEAT_VHE</span> is not implemented, or if HCR_EL2.E2H is 0, this field behaves as 1 for all purposes other than a direct read of the value of this bit.
</li><li>When <span class="xref">FEAT_VHE</span> is implemented and HCR_EL2.E2H is 1, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
</li></ul>
<p>For more information, see <span class="xref">'Asynchronous exception routing'</span>.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-3_3">FMO, bit [3]</h4><div class="field">
      <p>Physical FIQ Routing.</p>
    <table class="valuetable"><tr><th>FMO</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td><p>When executing at Exception levels below EL2, and EL2 is enabled in the current Security state:</p>
<ul>
<li>When the value of HCR_EL2.TGE is 0, Physical FIQ interrupts are not taken to EL2.
</li><li>When the value of HCR_EL2.TGE is 1, Physical FIQ interrupts are taken to EL2 unless they are routed to EL3.
</li><li>Virtual FIQ interrupts are disabled.
</li></ul></td></tr><tr><td class="bitfield">0b1</td><td><p>When executing at any Exception level, and EL2 is enabled in the current Security state:</p>
<ul>
<li>Physical FIQ interrupts are taken to EL2, unless they are routed to EL3.
</li><li>When HCR_EL2.TGE is 0, then Virtual FIQ interrupts are enabled.
</li></ul></td></tr></table><p>If EL2 is enabled in the current Security state and the value of HCR_EL2.TGE is 1:</p>
<ul>
<li>Regardless of the value of the FMO bit, physical FIQ Interrupts target EL2 unless they are routed to EL3.
</li><li>When <span class="xref">FEAT_VHE</span> is not implemented, or if HCR_EL2.E2H is 0, this field behaves as 1 for all purposes other than a direct read of the value of this bit.
</li><li>When <span class="xref">FEAT_VHE</span> is implemented and HCR_EL2.E2H is 1, this field behaves as 0 for all purposes other than a direct read of the value of this bit.
</li></ul>
<p>For more information, see <span class="xref">'Asynchronous exception routing'</span>.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-2_2">PTW, bit [2]</h4><div class="field">
      <p>Protected Table Walk. In the EL1&amp;0 translation regime, a translation table access made as part of a stage 1 translation table walk is subject to a stage 2 translation. The combining of the memory type attributes from the two stages of translation means the access might be made to a type of Device memory. If this occurs, then the value of this bit determines the behavior:</p>
    <table class="valuetable"><tr><th>PTW</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>The translation table walk occurs as if it is to Normal Non-cacheable memory. This means it can be made speculatively.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>The memory access generates a stage 2 Permission fault.</p>
        </td></tr></table><p>This bit is permitted to be cached in a TLB.</p>
<p>When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-1_1">SWIO, bit [1]</h4><div class="field">
      <p>Set/Way Invalidation Override. Causes EL1 execution of the data cache invalidate by set/way instructions to perform a data cache clean and invalidate by set/way:</p>
    <table class="valuetable"><tr><th>SWIO</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>This control has no effect on the operation of data cache invalidate by set/way instructions.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>Data cache invalidate by set/way instructions perform a data cache clean and invalidate by set/way.</p>
        </td></tr></table><p>When the value of this bit is 1:</p>
<p>AArch32: <a href="AArch32-dcisw.html">DCISW</a> performs the same invalidation as a <a href="AArch32-dccisw.html">DCCISW</a> instruction.</p>
<p>AArch64: <a href="AArch64-dc-isw.html">DC ISW</a> performs the same invalidation as a <a href="AArch64-dc-cisw.html">DC CISW</a> instruction.</p>
<p>This bit can be implemented as <span class="arm-defined-word">RES1</span>.</p>
<p>When HCR_EL2.TGE is 1, the PE ignores the value of this field for all purposes other than a direct read of this field.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><h4 id="fieldset_0-0_0">VM, bit [0]</h4><div class="field">
      <p>Virtualization enable. Enables stage 2 address translation for the EL1&amp;0 translation regime, when EL2 is enabled in the current Security state.</p>
    <table class="valuetable"><tr><th>VM</th><th>Meaning</th></tr><tr><td class="bitfield">0b0</td><td>
          <p>EL1&amp;0 stage 2 address translation disabled.</p>
        </td></tr><tr><td class="bitfield">0b1</td><td>
          <p>EL1&amp;0 stage 2 address translation enabled.</p>
        </td></tr></table><p>When the value of this bit is 1, data cache invalidate instructions executed at EL1 perform a data cache clean and invalidate. For the invalidate by set/way instruction this behavior applies regardless of the value of the HCR_EL2.SWIO bit.</p>
<p>This bit is permitted to be cached in a TLB.</p>
<p>When <span class="xref">FEAT_VHE</span> is implemented, and the value of HCR_EL2.{E2H, TGE} is {1, 1}, this field behaves as 0 for all purposes other than a direct read of the value of this bit.</p><p>The reset behavior of this field is:</p><ul><li>On a Warm reset, 
      this field resets
       to an architecturally <span class="arm-defined-word">UNKNOWN</span> value.</li></ul></div><div class="access_mechanisms"><h2>Accessing HCR_EL2</h2><p>Accesses to this register use the following encodings in the System register encoding space:</p><h4 class="assembler">MRS &lt;Xt&gt;, HCR_EL2</h4><table class="access_instructions"><tr><th>op0</th><th>op1</th><th>CRn</th><th>CRm</th><th>op2</th></tr><tr><td>0b11</td><td>0b100</td><td>0b0001</td><td>0b0001</td><td>0b000</td></tr></table><p class="pseudocode">
if PSTATE.EL == EL0 then
    UNDEFINED;
elsif PSTATE.EL == EL1 then
    if EL2Enabled() &amp;&amp; HCR_EL2.&lt;NV2,NV&gt; == '11' then
        X[t, 64] = NVMem[0x078];
    elsif EL2Enabled() &amp;&amp; HCR_EL2.NV == '1' then
        AArch64.SystemAccessTrap(EL2, 0x18);
    else
        UNDEFINED;
elsif PSTATE.EL == EL2 then
    X[t, 64] = HCR_EL2;
elsif PSTATE.EL == EL3 then
    X[t, 64] = HCR_EL2;
                </p><h4 class="assembler">MSR HCR_EL2, &lt;Xt&gt;</h4><table class="access_instructions"><tr><th>op0</th><th>op1</th><th>CRn</th><th>CRm</th><th>op2</th></tr><tr><td>0b11</td><td>0b100</td><td>0b0001</td><td>0b0001</td><td>0b000</td></tr></table><p class="pseudocode">
if PSTATE.EL == EL0 then
    UNDEFINED;
elsif PSTATE.EL == EL1 then
    if EL2Enabled() &amp;&amp; HCR_EL2.&lt;NV2,NV&gt; == '11' then
        NVMem[0x078] = X[t, 64];
    elsif EL2Enabled() &amp;&amp; HCR_EL2.NV == '1' then
        AArch64.SystemAccessTrap(EL2, 0x18);
    else
        UNDEFINED;
elsif PSTATE.EL == EL2 then
    HCR_EL2 = X[t, 64];
elsif PSTATE.EL == EL3 then
    HCR_EL2 = X[t, 64];
                </p></div><hr class="bottom_line"/><table style="margin: 0 auto;"><tr><td><div class="topbar"><a href="AArch32-regindex.html">AArch32 Registers</a></div></td><td><div class="topbar"><a href="AArch64-regindex.html">AArch64 Registers</a></div></td><td><div class="topbar"><a href="AArch32-sysindex.html">AArch32 Instructions</a></div></td><td><div class="topbar"><a href="AArch64-sysindex.html">AArch64 Instructions</a></div></td><td><div class="topbar"><a href="enc_index.html">Index by Encoding</a></div></td><td><div class="topbar"><a href="ext_alpha_index.html">External Registers</a></div></td><td><div class="topbar"><a href="ext_enc_index.html">External Registers by Offset</a></div></td><td><div class="topbar"><a href="func_index.html">Registers by Functional Group</a></div></td><td><div class="topbar"><a href="notice.html">Proprietary Notice</a></div></td></tr></table><p class="versions">30/03/2023 19:06; 997dd0cf3258cacf72aa7cf7a885f19a4758c3af</p><p class="copyconf">Copyright © 2010-2023 Arm Limited or its affiliates. All rights reserved. This document is Non-Confidential.</p></body>
</html>
